Workbook Power Part I tcm109-170742

Document Name: RIMAP Application Workbook for
Power Plants
Document Date: 26.03.2003

Document Author/s: RIMAP Consortium
Reference Number: 4-41-W-2002-01-0
Version: Final
Contract Number: G1RD-CT-2001-03008
RIMAP Consortium
Det Norske Veritas AS (DNV) ExxonMobil Chemical Ltd. (Exxon)
Bureau Veritas (BV) Energie Baden-Württemberg AG (EnBW)
Staatliche Materialprüfungsanstalt (MPA) Siemens AG (Siemens)
Joint Research Centre of the European Commis-
VTT Industrial Systems (VTT)
sion (JRC)
TÜV Industrie Service, TÜV SÜD Group Electricity Supply Board (ESB)
TNO Industrial Technology (TNO) Corus Ltd.
Hydro Agri Sluiskil B.V. (Norsk Hydro) The Dow Chemical Company N.V. (DOW)
Mitsui Babcock Energy Ltd. (MBEL) Solvay S.A.
No distribution outside RIMAP Consortium

No distribution outside RIMAP Thematic Network
No distribution without prior approval by RIMAP Consortium
Unrestricted distribution
© COPYRIGHT 2004 THE RIMAP Consortium
This document may not be copied, reproduced, or modified in whole or in part for any purpose without written
permission from the RIMAP Consortium. In addition, to such written permission to copy, acknowledgement of the
authors of the document and all applicable portions of the copyright notice must be clearly referenced.
All rights reserved

Risk Based Inspection and Maintenance procedures for European industry
Risk based Inspection and MAintenance Procedures for European industry (RIMAP) is an
EU funded initiative1. RIMAP consists of 3 projects: a research and technological develop-
ment project (RTD), a demonstration project (DEMO) and a Thematic Network (TN).
The background for the RIMAP project is that current practice to inspection and maintenance
planning for most industries is based on tradition and prescriptive rules, rather than being an
optimized process where risk measures for safety and economy are integrated. New tech-
nology for taking risk based decisions is emerging in a broad range of sectors, and they have
proven to be a very efficient tool. There is a great need to define the technical content, links
to local legislation and to integrate this approach with the day-to-day operation of the plants.
The RIMAP project shall:

• Develop a unified approach to risk based inspection and maintenance planning.
• Set requirements to the contents of an analysis, personnel qualifications, and tools.
• Provide the basis for future standardisation within risk based inspection and mainte-
nance.
The work in the RIMAP RTD project has been organised as follows:
• WP1: Current practice within the involved industries.
• WP2: Development of a generic RBIM method, based on a multi-criteria decision
process.
• WP3: Development of detailed risk assessment methods, damage models for differ-
ent industry sectors, the use of inspection data.
• WP4: Development of RIMAP application workbooks: guidelines for development of
Risk Based Inspection and Maintenance plans.
• WP5: Validation of the RIMAP methodology.
RIMAP RTD reporting structure is given in below:
Exec. Summary & Introduction to RIMAP

RIMAP Documentation Level - I D2.2
D2.1 RIMAP Procedure
RIMAP Framework RIMAP Validation / Benchmarking
Requirements
Overview Document (D3.1)

RIMAP Documentation Level - II
Damage NDT Human
Mechanisms
PoF CoF
Efficiency factors
RIMAP Tools
D3.1 and I3.x as Appendices to D3.1
RIMAP Documentation Level - III
RIMAP Application Power Petrochemical Steel Chemical

Workbooks
D4.x
WP 5 RIMAP Validation/Benchmarking
The RIMAP DEMO project consists of four demonstration cases, one for each of the involved
industry sectors: petrochemical, power, steel, and chemical industry. The techniques can
easily be extended to other industry sectors.
The RIMAP TN accompanies the RTD and DEMO projects by disseminating the information,
and results of the RTD and DEMO part to a wider community of companies that review re-
sults and generate an overall industry acceptance.
1
The RIMAP project would like to acknowledge the financial support by the European Commission for the "GROWTH Pro-
gramme, Research Project RIMAP Risk Based Inspection and Maintenance Procedures for European Industry "; Contract Num-
ber G1RD-CT-2001-03008. Without this support it would not have been possible to complete this work.
GROWTH Project G1RD-CT-2001-03008 “RIMAP”
Document title: RIMAP Application Workbook for Power Industry
Document number: 4-41-W-2002-01-0
Table of contents
1. CONCLUSIVE SUMMARY ...........................................................................................12
2. INTRODUCTION...........................................................................................................12
2.1 GENERAL .................................................................................................................12
2.2 REQUIREMENTS AND SCOPE .....................................................................................13
2.3 HOW TO USE THIS DOCUMENT ...................................................................................15
3. RIMAP PROCEDURE FOR POWER PLANT COMPONENTS....................................16
3.1 GENERAL .................................................................................................................16
3.2 STANDARD FORMAT FOR EACH STEP .........................................................................17
3.3 PREPARATORY ANALYSIS .........................................................................................18
3.3.1 General ..........................................................................................................18
3.3.1.1 Description ........................................................................................................................... 18
3.3.1.2 Requirements....................................................................................................................... 18
3.3.1.3 Input ..................................................................................................................................... 19
3.3.1.4 Procedure/flowcharts............................................................................................................ 19
3.3.1.5 Output .................................................................................................................................. 19
3.3.2 Definition of boundaries ..............................................................................19
3.3.2.1 Description ........................................................................................................................... 19
3.3.2.2 Output .................................................................................................................................. 20
3.3.2.3 Definition of objectives and scope........................................................................................ 20
3.3.2.4 Description ........................................................................................................................... 20
3.3.3 Regulatory requirements .............................................................................20
3.3.3.1 Description ........................................................................................................................... 20
3.3.4 Engineering criteria ......................................................................................20
3.3.4.1 Description ........................................................................................................................... 20
3.3.4.2 Requirements....................................................................................................................... 20
3.3.4.3 Input ..................................................................................................................................... 20
3.3.4.4 Warnings, applicability limits ................................................................................................ 20
3.3.4.5 Examples ............................................................................................................................. 20
3.3.5 Risk acceptance criteria...............................................................................21
3.3.5.1 Description ........................................................................................................................... 21
3.3.5.2 Requirements....................................................................................................................... 22
3.3.5.3 Examples ............................................................................................................................. 23
3.3.6 Preliminary Identification of hazards..........................................................25
3.3.6.1 Description ........................................................................................................................... 25
3.3.6.2 Requirements....................................................................................................................... 27
3.3.6.3 Input ..................................................................................................................................... 27
3.3.6.5 Output .................................................................................................................................. 29
3.4 DATA COLLECTION AND VALIDATION .........................................................................29
3.4.1 General ..........................................................................................................29
3.4.1.1 Description ........................................................................................................................... 29
3.4.1.2 Requirements....................................................................................................................... 29
3.4.2 Design, manufacturing, construction data.................................................30
3.4.2.1 Description ........................................................................................................................... 30
3.4.3 Operating and equipment history ...............................................................30
3.4.3.1 Description ........................................................................................................................... 30
3.4.4 Generic/equivalent data ...............................................................................31
3.4.4.1 Description ........................................................................................................................... 31
3.5 MULTILEVEL RISK ANALYSIS AND DECISION MAKING ..................................................31
3.5.1 General ..........................................................................................................32
3.5.1.1 Description ........................................................................................................................... 32
3.5.2 Risk screening ..............................................................................................33
3.5.2.1 Description ........................................................................................................................... 33
Revision number: 0 Page 3 of 135 Restricted

3.5.2.2 Requirements....................................................................................................................... 34
3.5.2.3 Input ..................................................................................................................................... 34
3.5.2.5 Minimal (adequate) measures.............................................................................................. 37
3.5.2.6 Output .................................................................................................................................. 37
3.5.2.8 Tools .................................................................................................................................... 37
3.5.3 Detailed analysis...........................................................................................37
3.5.3.1 Description ........................................................................................................................... 37
3.5.3.2 Requirements....................................................................................................................... 37
3.5.3.3 Input ..................................................................................................................................... 38
3.5.3.4 Identify relevant damage mechanisms and failure modes.................................................... 38
3.5.3.5 Determine likelihood / probability of failure........................................................................... 38
3.5.3.6 Determine consequence of failure........................................................................................ 39
3.5.3.8 Construct equipment hierarchy ............................................................................................ 40
3.5.3.9 Identify relevant damage mechanisms and failure modes.................................................... 41
3.5.3.10 Determine probability of failure............................................................................................. 41
3.5.3.11 Determine consequence of failure........................................................................................ 41
3.5.3.12 Consider conservative inspection/maintenance ................................................................... 42
3.5.3.13 Risk assessment .................................................................................................................. 42
3.5.3.14 Decision logic ....................................................................................................................... 42
3.5.3.15 Output .................................................................................................................................. 44
3.5.3.17 Tools .................................................................................................................................... 44
3.5.4 Multilevel analysis ........................................................................................44
3.5.4.1 Examples ............................................................................................................................. 44
3.6 IMPLEMENTATION OF PLANS .....................................................................................45
3.6.1 General ..........................................................................................................45
3.6.2 Development of the I&M plan ......................................................................45
3.6.2.1 Description ........................................................................................................................... 45
3.6.2.2 Requirements....................................................................................................................... 46
3.6.2.3 Input ..................................................................................................................................... 46
3.6.2.5 Output .................................................................................................................................. 47
3.6.3 Examples .......................................................................................................48
3.6.4 Execution of the I&M plan............................................................................48
3.6.4.1 Description ........................................................................................................................... 48
3.6.4.2 Requirements....................................................................................................................... 49
3.6.4.3 Input ..................................................................................................................................... 49
3.6.4.5 Output .................................................................................................................................. 49
3.7 EVALUATION OF THE PROCESS .................................................................................50
3.7.1 Description ....................................................................................................50
3.7.2 Requirements................................................................................................50
3.7.3 Input ...............................................................................................................50
3.7.3.1 Assessment of effectiveness................................................................................................ 50
3.7.3.2 Reassessment of risk ........................................................................................................... 51
3.7.4 Procedure/flowchart .....................................................................................51
3.7.5 Output ............................................................................................................52
3.7.6 Warnings, applicability limits ......................................................................52
4. PROBLEM AND HAZARD IDENTIFICATION – DAMAGE MECHANISMS, PLANT
HIERARCHY ..........................................................................................................................52
4.1 DAMAGE SYSTEMATICS ............................................................................................53
4.1.1 WHERE to look for (inspect / monitor) for which type of damage ...........55

4.1.2 HOW to look for (inspect / monitor) for which type of damage................59
4.1.3 How to analyse and predict development of given types of damage ......64
4.2 PLANT BREAKDOWN - STANDARD POWER PLANT HIERARCHY FOR RBI / RBLM: WHAT
KIND OF PROBLEMS ARE MOST LIKELY TO APPEAR AND WHERE .............................................67
4.2.1 RIMAP Power Plant Standard Hierarchy ....................................................67
4.2.2 Example of plant hierarchy from process industry ...................................71
4.2.3 Hierarchy vs. Problems covered by the RIMAP Power Workbook...........73
5. MULTILEVEL RISK ANALYSIS...................................................................................79
5.1 INTRODUCTION .........................................................................................................79
5.2 PROBABILITY OF FAILURE DETERMINATION ...............................................................79
5.3 CONSEQUENCE OF FAILURE DETERMINATION ...........................................................82
5.4 RISK – GETTING A “BOW TIE” ..................................................................................82
6. STANDARD DATA FORMAT FOR THE RBI/RBLM IN RIMAP WORKBOOK FOR
POWER PLANTS ..................................................................................................................82
6.1 FORMAT FOR SYSTEM / COMPONENT RECORDS.........................................................82
6.2 FORMAT FOR PROBLEM RELATED RECORDS .............................................................84
6.3 EXAMPLE “FORMATTING” OF INFORMATION FOR THE PURPOSE OF RBLM ANALYSIS:
ECONOMIZER (HAC) ........................................................................................................85
6.4 BOILER GENERAL ....................................................................................................86
6.5 BOILER TUBES .........................................................................................................91
6.6 ECONOMIZER TUBING ...............................................................................................95
6.7 PROBLEM #1: ECONOMISER TUBE FAILURES DUE TO WALL THINNING.......................103
6.8 PROBLEM #2: ECONOMISER CRACKING ..................................................................106
7. WORKED EXAMPLES ...............................................................................................109
7.1 MULTILEVEL RISK ANALYSIS – POWER PLANT ..........................................................109
7.1.1 Technical background................................................................................109
7.1.2 Sample case ................................................................................................113
7.1.3 Screening level ...........................................................................................114
7.1.4 Intermediate level .......................................................................................120
7.1.5 Detailed level...............................................................................................121
7.2 EXAMPLES FROM PROCESS INDUSTRY.....................................................................124
7.2.1 Example of PoF calculation for distillation tower overhead system .....124
7.2.1.1 Design information ..............................................................................................................124
7.2.1.2 Process information ............................................................................................................124
7.2.1.3 Corrosion information ..........................................................................................................125
7.2.1.4 Pof Calculation ....................................................................................................................126
7.2.2 Example of PoF calculation for HF stripper top.......................................130
7.2.2.1 Calculation process .............................................................................................................130
7.2.2.2 Design information ..............................................................................................................130
7.2.2.3 Process information ............................................................................................................130
7.2.2.4 Corrosion information ..........................................................................................................131
7.2.2.5 Inspection history ................................................................................................................131
7.2.2.6 PoF calculation....................................................................................................................131
8. RISK CONSIDERATION ............................................................................................132
9. CONCLUSIONS..........................................................................................................132
10. REFERENCES ...........................................................................................................133

List of tables
TABLE 2-1 SCOPE OF THE WORKBOOK CONCERNING MAIN SYSTEMS .........................................14
TABLE 2-2 “ROAD MAP” OF THE DOCUMENT .............................................................................15
TABLE 3-1 EXAMPLES OF ENGINEERING CRITERIA FOR DETERMINING A FAILURE........................21
TABLE 3-2 RISK CRITERIA........................................................................................................21
TABLE 3-3 INDIVIDUAL RISK FOR PUBLIC. .................................................................................23
TABLE 3-4 INDIVIDUAL RISK FOR WORKERS. ............................................................................24
TABLE 3-5 SOCIETAL RISK FOR PUBLIC. ..................................................................................24
TABLE 3-6 SOCIETAL RISK FOR WORKERS...............................................................................24
TABLE 3-7 INFORMATION REQUIREMENTS.................................................................................30
TABLE 3-8 COMPONENT FAILURE DATABASE CONSIDERATIONS.................................................31
TABLE 3-9 EXAMPLES OF DECISION LOGIC APPLICATION...........................................................43
TABLE 4-1 TYPES OF IN-SERVICE DAMAGE AND THEIR SPECIFICS: CLASSIFICATION ADOPTED IN
THIS WORK.......................................................................................................................54
TABLE 4-2 CLASSIFICATION OF TYPE OF DAMAGE VS. SYSTEMS/COMPONENTS IN DIFFERENT
TYPES OF PLANTS (FPP – FOSSIL POWER PLANTS, NPP – NUCLEAR POWER PLANTS, PRP –
PROCESS PLANTS; WELD CRITICAL IN ALL COMPONENTS) ..................................................56
TABLE 4-3 CLASSIFICATION OF TYPE OF DAMAGE VS. PRIORITIZED METHODS OF INSPECTION.....60
TABLE 4-4 SUGGESTED MEASURES FOR PRE-SYMPTOM APPEARANCE MEASURES LEADING TO
EARLY DISCOVERY OF DAMAGE IN PLANTS ........................................................................63
TABLE 4-5 SUGGESTED METHODS FOR THE ANALYSIS DEPENDING ON DAMAGE TYPES...............65
TABLE 4-6 RIMAP POWER PLANT HIERARCHY .........................................................................68
TABLE 4-7 EXAMPLE OF TYPICAL PROCESS PLANT BREAKDOWN (PLANT / UNIT / SUB-UNIT) ......71
TABLE 4-8 EXAMPLE OF LIST OF PROCESS EQUIPMENT WITH MAIN TECHNOLOGIES ....................72
TABLE 4-9 LIST OF PROCESS SUB EQUIPMENT - EXAMPLE .........................................................73
TABLE 4-10 AN EXAMPLE OF LINKING COMPONENTS, DAMAGE MECHANISMS AND INSPECTIONS
TECHNIQUES (EPRI).........................................................................................................74
TABLE 4-11 AN EXAMPLE OF LINKING COMPONENTS, DAMAGE MECHANISMS AND INSPECTIONS
TECHNIQUES (INNOGY)...................................................................................................75
TABLE 4-12 HRSG COMPONENTS AND THEIR VULNERABILITY TO DAMAGING MECHANISMS
(PASHA, ALLEN, 2003) ....................................................................................................76
TABLE 4-13 COMPONENT HIERARCHY VS. PROBLEMS ...............................................................78
TABLE 6-1 TYPICAL DESIGN CONDITIONS FOR 400MW PULVERIZED COAL FIRED BOILERS..........87
TABLE 6-2 FORCED AND SCHEDULED OUTAGES AND DERATINGS OF BOILERS (NERC GADS
DATA 1992-1996)............................................................................................................89
TABLE 6-3 BOILER TUBE FAILURE MECHANISMS. ......................................................................92
TABLE 6-4 LOSS OF AVAILABILITY DUE TO BOILER TUBE FAILURES (A.F. ARMOR, R.H.WOLK,
PRODUCTIVITY IMPROVEMENT HANDBOOK FOR FOSSIL STEAM POWER PLANTS, EPRI,
SEPTEMBER,1998.)..........................................................................................................94
TABLE 7-1 COMPONENT DESIGN DATA....................................................................................114
TABLE 7-2 CALCULATED COMPONENT EXHAUSTION VALUES ...................................................115
TABLE 7-3 DISTILLATION TOWER TOP PART - PROCESS ..........................................................124
TABLE 7-4 PROBABILITY OF FAILURE AFTER 5 YEARS .............................................................126
TABLE 7-5 ASSUMED VALUE OF POF BEFORE ANY INSPECTION ...............................................126
TABLE 7-6 VALUE OF PROBABILITY AFTER THE 1ST INSPECTION ...............................................127
TABLE 7-7 POF RESULTS AFTER COMPLETION OF A HIGHLY EFFECTIVE INSPECTION ................127
TABLE 7-8 POF RESULTS AFTER COMPLETION OF A USUALLY EFFECTIVE INSPECTION .............127
TABLE 7-9 POF RESULTS AFTER COMPLETION OF A FAIRLY EFFECTIVE INSPECTION .................127
TABLE 7-10 PROBABILITY OF FAILURE AFTER 5 YEARS ...........................................................128
TABLE 7-11 ASSUMED VALUE OF POF BEFORE ANY INSPECTION .............................................128
TABLE 7-12 VALUE OF PROBABILITY AFTER THE 1ST INSPECTION .............................................129
TABLE 7-13 POF RESULTS AFTER COMPLETION OF A HIGHLY EFFECTIVE INSPECTION ..............129
TABLE 7-14 POF RESULTS AFTER COMPLETION OF A USUALLY EFFECTIVE INSPECTION ...........129

TABLE 7-15 POF RESULTS AFTER COMPLETION OF A FAIRLY EFFECTIVE INSPECTION ...............129
TABLE 7-16 DISTILLATION TOWER TOP PART - PROCESS ........................................................131
TABLE 7-17 HYDROGEN EMBRITTLEMENT CORROSION DATA ...................................................131
List of figures
FIGURE 1-1 POWER INDUSTRY APPLICATION WORKBOOK IN RIMAP FRAMEWORK ...................12
FIGURE 2-1 RIMAP APPLICATION WORKBOOK FOR POWER INDUSTRY STRUCTURE ..................13
FIGURE 3-1 BASIC REPRESENTATION OF RIMAP PROCEDURE...................................................17
FIGURE 3-2 EXAMPLE OF RISK MATRIX.....................................................................................22
FIGURE 3-3 PROCEDURE FOR THE IDENTIFICATION OF HAZARDS................................................28
FIGURE 3-4 RISK SCREENING. ..................................................................................................33
FIGURE 3-5 SCREENING RISK MATRIX ......................................................................................36
FIGURE 3-6 DETAILED ASSESSMENT .........................................................................................40
FIGURE 3-7 DECISION LOGIC....................................................................................................43
FIGURE 3-8 EXAMPLE OF POF (LOF) CALCULATION..................................................................44
FIGURE 3-9 EXAMPLE OF POF (LOF) ISSUES IN PRACTICE (POWER PLANT)................................45
FIGURE 3-10 EVALUATION OF THE RISK-BASED DECISION MAKING PROCESS.............................52
FIGURE 4-1 DAMAGE CONSIDERATIONS IN THIS WORKBOOK ......................................................53
FIGURE 4-2 EXAMPLE OF TYPICAL HIERARCHY (BREAKDOWN) STRUCTURE; USUALLY THE LEVELS
ARE OPTIONAL AND THE PROBLEM/ISSUE SUB HIERARCHY CAN BE ATTACHED AT VIRTUALLY
ANY LEVEL .......................................................................................................................68
FIGURE 5-1 SIMPLIFIED BOW TIE MODEL WITH POF ON ONE SIDE AND COF ON THE OTHER ........79
FIGURE 5-2 ELEMENTS OF POF DETERMINATION IN RIMAP ......................................................80
FIGURE 5-3 MULTILEVEL POF ANALYSIS...................................................................................81
FIGURE 6-1 FULL SET OF ELEMENTS FOR THE RBLM ANALYSIS OF THE ECONOMIZER ................85
FIGURE 6-2 THE SUBSET OF ELEMENTS CHOSEN FOR THE RBLM ANALYSIS TAKEN FOR THIS
EXAMPLE .........................................................................................................................86
FIGURE 6-3 BOILER HEAT FLOWS (EPRI). ................................................................................87
FIGURE 6-4 TYPICAL BOILER LAYOUT. ......................................................................................88
FIGURE 6-5 MAJOR PROBLEMS IN CYCLING FOSSIL BOILERS (A.F. ARMOR, R.H.WOLK,
PRODUCTIVITY IMPROVEMENT HANDBOOK FOR FOSSIL STEAM POWER PLANTS, EPRI,
SEPTEMBER,1998.)..........................................................................................................89
FIGURE 6-6 EQUIVALENT UNAVAILABILITY FACTOR (EUF) DUE TO BOILER TUBE FAILURES IN
COAL PLANTS LARGER THAN 200 MW (A.F. ARMOR, R.H.WOLK, PRODUCTIVITY
IMPROVEMENT HANDBOOK FOR FOSSIL STEAM POWER PLANTS, EPRI, SEPTEMBER,1998.)
.......................................................................................................................................91
FIGURE 6-7 CORROSION IN ECONOMISER TUBES .......................................................................96
FIGURE 6-8 DAMAGE AT BUNDLE BRACES OF AN ECONOMISER TUBE .........................................96
FIGURE 6-9 TYPICAL LOCATIONS FOR EROSION, CORROSION, DAMAGE AT BUNDLE BRACES
(SPRINT PROJECT SP249, DOCUMENT GG010) ..............................................................97
FIGURE 6-10 DEPENDENCY BETWEEN DIFFERENT FAILURE MODES. .........................................102
FIGURE 7-1 CREEP EXHAUSTION CALCULATION BASED ON TRD (NOW EN 12952)...................110
FIGURE 7-2 TRD FATIGUE CURVE (WITH DERIVED MEAN VALUE CURVE) AT 400°C...................110
FIGURE 7-3 COMPONENT GEOMETRY DATA .............................................................................111
FIGURE 7-4 DESIGN AND OPERATING TEMPERATURE AND PRESSURE ......................................111
FIGURE 7-5 SERVICE TIME OF THE COMPONENT ......................................................................112
FIGURE 7-6 EXAMPLE OF DISTRIBUTION FOR CREEP RUPTURE STRENGTH AT 520°C ................113
FIGURE 7-7 EXAMPLE OF DISTRIBUTION FOR FATIGUE STRENGTH AT 400°C ............................113
FIGURE 7-8 SCREENING LEVEL POF ANALYSIS IN ALIAS-RISK ...............................................116
FIGURE 7-9 DEFINING POF CLASSES USING ALIAS-RISK ........................................................116
FIGURE 7-10 DEFINING COF CLASSES USING ALIAS-RISK .....................................................117

FIGURE 7-11 BUILDING FAILURE SCENARIOS USING ALIAS-RISK ............................................118

FIGURE 7-12 “BOW TIE” FOR SUPEHEATER COMPONENT ........................................................118
FIGURE 7-13 IMPORTED CALCULATED POF VALUES ................................................................119
FIGURE 7-14 INPUT OF COF VALUES ......................................................................................119
FIGURE 7-15 RISK MAP AFTER SCREENING LEVEL ...................................................................120
FIGURE 7-16 RISK MAP AFTER INTERMEDIATE ANALYSIS .........................................................121
FIGURE 7-17 CREEP CRACK GROWTH WITH C* (FORM FACTOR 2.5) (JOVANOVIC, MAILE, 2001))
.....................................................................................................................................122
FIGURE 7-18 SUPERHEATER COMPONENT ON A RISK MAP AFTER DETAILED ANALYSIS .............122
FIGURE 7-19 EXAMPLE OF CALCULATING POF FOR THE SAMPLE CASE CONSIDERED ...............123
FIGURE 7-20 CALCULATION PROCESS – NON TRENDABLE DAMAGES .......................................130
FIGURE 7-21 API 581 CALCULATION PROCESS FOR NON TRENDABLE DAMAGES ......................132
List of Acronyms
The following table provides meanings/explanations for acronyms used in this documents.
Acronym Meaning
AAR Advanced Assessment Route (in SP249)
ACRS Advisory Committee on Reactor Safeguards (in the USA)
AHP Analytical Hierarchy Process
AI Artificial Intelligence
AI&DM Artificial Intelligence & Data Mining
AIChE / CCPS American Institute of Chemical Engineers / Center for Chemi-
cal Process Safety, 345 East 47th Street, New York 10017
ALIAS Advanced modular intelligent Life Assessment Software Sys-
tem, a product of MPA Stuttgart, Germany
(see more on http://www.mpa-lifetech.de/)
AMES European Network on Ageing Materials Evaluation and Stud-
ies
ASME American Society of Mechanical Engineers, ASME Interna-
tional, 3 Park Avenue, New York, New York 100 16.
(http://www.asme.org/asme/ )
BFS Betriebsführungssystem, Operation Management System,

of Siemens company, Germany
(http://w2.siemens.de/kwu/e/foa/n/news/kwu047e.htm )
BRITE One of the CEC programs for technological R&D in Europe,
initially an acronym, nowadays a name of the program only
BS British Standard (http://www.bsi.org.uk/)
CAD Computer-aided Design
CCM Condition-Centred Maintenance
CEC The Commission of the European Communities
(http://europa.eu.int/)
CEGB Central Electricity Generating Board, former nationally owned
power utility for England and Wales (see Pollitt, Newbery,
1996)
CLA Component (remaining) Life Assessment / Analysis
CLM Component Life Management
CRO Consulting and Research Organization
DG, DG III, DG XIII Directorate General, DG III "Industry", DG XIII " Telecommu-
nications, Information Market and Exploitation of Research"of

Acronym Meaning
the CEC (see http://europa.eu.int/comm/dgs_en.htm)
DIN Deutsche Industrienorm - German Standards
(http://www.din.de)
DNV Det Norske Veritas, Hovik, Norway (http://www.dnv.no)
DSS Decision Support System(s)
EIA Energy Information Administration of National Energy Infor-
mation Center (http://www.eia.doe.gov/), US Department of
Energy
EnBW Energie Baden-Württemberg AG
(http://www.enbw.com/index.html)
EnBW/EVS EnBW Energie Versorgung Schwaben AG
(http://www.enbw.com/wir/wir.html)
EnBW/BW EnBW Badenwerk AG
(http://www.enbw.com/wir/wir.html)
ENIQ European Network for Inspection Qualification
EPA US Environmental Protection Agency, 401 M Street, S.W.,
Washington, D.C. 20406
EPERC European Pressure Equipment Research Council (http://sci-
sj-02.jrc.nl/eperc/ )
EPRI Electric Power Research Institute, Palo Alto, USA
(http://www.epri.com)
ERA ERA Technology Ltd., Leatherhead, UK
(http://www.eureka.era.co.uk)
ESR Expert System for Remaining Life Assessment, Expertensys-
tem zur Schadens- und Restlebensdaueranalyse
ET Eddy Current inspection
EU European Union (http://europa.eu.int/)
FBAHP Fuzzy-Bayesian Analytical Hierarchy Process
FPP Fossil-fired Power Plant
GOPP Goal-oriented Project Planning
HAZ Heat affected zone (in welds)
HAZOP Hazard and Operability (see DIN IEC 56/581/CD)
IEC International Electrotechnical Commission
IP Inspection Planning
ISS Information Software System (as in IEC 61508)
IVO Imatran Voima Oy, company (http://www.ivogroup.com)
JRC Joint Research Center(s) of The European Community
(http://www.jrc.org/jrc/index.asp); for this work relevant those
in Petten, The Netherlands and Ispra, Italy
KI Künstliche Intelligenz (artificial intelligence)
KMS Knowledge Management System (KMS)
KonTraG Gesetz zur Kontrolle und Transparenz im Unternehmensbe-
reich (KonTraG) v. 27.4.1998, BGB1. I 1998, 786
KWL Kraftwerk Laufenburg, Germany (http://www.kwl.de/)
MADM Multi-attribute decision making
MCDM Multi-criteria decision making
MPA (Staatliche) Materialprüfungsanstalt, State Institute for Test-
ing of Materials, Germany; MPA Stuttgart
(http://www.mpa.uni-stuttgart.de)
MT Magnetic (particle) testing
MTBF Mean time between failures

Acronym Meaning
(see "")
MVV Mannheimer Versorgungs- und Verkehrsgesellschaft mbH,
Mannheim, Germany (http://www.mvv.de/)
NDE Non-Destructive Examination
NDT Non-Destructive Testing
NESC Network for Evaluating Steel Components
NFPA US National Fire Protection Association, 1 Batterymarch
Park, Quincy, Massachusetts 02269
NPP Nuclear Power Plant
OECD Organization for Economic Cooperation and Development
(http://www.oecd.org/)
OR Operation Research (see RWTH http://www.rwth-aachen.de)
OSHA US Occupational Safety and Health Administration, U.S. De-
partment of Labor, Washington, D.C. 20402
PAIS PLAN Horizontal Theme for Advanced Information Systems –
a sub-activity in PLAN project (http://www.mpa-lifetech.de )
PISC Programme for the Inspection of Steel Components
PLAN Plant Life Assessment Network of JRC Petten, CEC countries
(see http://sci-sj-02.jrc.nl/plan/index.html)
PLAN-East Plant Life Assessment Network of MPA Stuttgart – Countries
of Central and Eastern Europe (http://www.mpa-lifetech.de)
PM plant maintenance
PRA Probabilistic Risk (Reliability) Assessment (Analysis)
PrP Process Plants
PSA Probabilistic Safety Analysis)
PT (liquid) Penetrant Testing (Inspection, visible and fluorescent)
R&D Research and Development
RBI Risk-Based Inspection
RBISI Risk-Based In-Service Inspection
RCM Reliability-Centered Maintenance
RCLM Risk-informed Component Life Management, Risk-aware
Component Life Management (used as a synonym)
RLA Remaining Life Assessment / Analysis, Restlebensdauerana-
lyse
RLM Remaining Life Management / Restlebensdauermanagement
ROI return of investment
RP Replica Testing
RRLM Risk-informed Remaining Life Management
RT, RX Radiography testing, X-ray testing
RTD (ASME) Research and Technology Development Center
(see also http://www.asme.org/asme/)
RWE earlier Rheinsch-Westfälische-Elektrizitätswerke, nowadays
only RWE Energie (http://www.rweenergie.de/index_eng.htm)
SCADA Supervisory Control And Data Acquisition
SCC Stress Corrosion Cracking
SIL Safety Integrity Levels (defined in IEC 61508)
SME small and medium enterprise (a EU-term)
SPM Structured Project Management (see ETP
http://www.etpint.com)
SPRINT Strategic Programme for Innovation and Technology Transfer
(Projects part-funded by DG-XIII of the EU, see above), re-

Acronym Meaning
placed in late 1990s by other initiatives like LIFE
SRCM Streamlined reliability-centered maintenance
SRRA Structural Reliability Risk Assessment
TPM Total Productive Maintenance
TQM Total Quality Management
TRD Technische Regeln für Dampfkessel, German boiler code
TTF Technical Task Force (of EPERC, see e.g. TTF3 http://sci-sj-
02.jrc.nl/eperc/projects/ttf3.html )
TÜV “Technischer Überwachungsverein“ – German inspection and
certification bodies, nowadays independent companies (see
e. g. http://www.tuev-rheinland.de/)
US, UT Ultrasonic testing (inspection)
VGB Vereinigung der Großkraftwerkbetreiber e. V., Essen, Ger-
many
VT Visual Testing
VTT Technical Research Centre of Finland (http://www.vtt.fi/)
XPS FIRE eXPert System for FIre insurance Risk Evaluation
(see also http://www.munichre.com)
ZT Emerging testing (inspection) methods and techniques

1. Conclusive summary
This document represents full “hands on”, RIMAP application guide for performing a risk
analysis mainly concentrating on the equipment and problems that can be found in power
plants. Furthermore it can be used in other types of industries for similar components.
The position of this guideline in overall RIMAP framework is shown in Figure 1-1
WP2
RIMAP
Framework
RIMAP
Workprocess Subchapter 7.6
RIMAP Guideline WP3.1
D2.2 Chapter 8
RIMAP (covers RIMAP
Procedure
Framework)
Appendix of the Guideline,

RIMAP Procedure, at different Application
levels/steps Workbook
D2.1 Power Industry
WP4 RIMAP Application D4
Workbooks
DEMO2 RIMAP Procedure Application Reports

from RIMAP Demo Project
Figure 1-1 Power Industry Application Workbook in RIMAP Framework

The RIMAP procedure is explained here and supported in the following chapters with raw
(live) data needed for the analysis and by examples showing the complete process of a risk
analysis, from Preparatory analysis to Implementation. The Workbook by it’s structure follows
the RIMAP procedure.
2. Introduction
2.1 General
According to the RIMAP project work plan (WP4) this report covers the POWER PLANT
RELATED PART of RIMAP WP4 deliverables (WP4: RIMAP Application Workbooks). Hence
it combines / couples the deliverables:
D4.1 Guidelines on how to set up inspection/maintenance program based on risk,
cost and experience feedback. Define the main working process involved, here power
plants,
D4.2 Guideline on how to benchmark an inspection program based on cost, risk and
experience, here power plants,
D4.3 Workbook per industry sector, here power plants
Deliverable D4.3 is, obviously the whole of the workbook. Deliverables D4.1 and D4.2 are
provided within the PART I of the workbook while the PART II and PART III give detailed
data on item per item basis and describe in detail all elements on assessing the risk, respec-
tively.
The deliverables have been merged due to the need to have one document containing virtu-
ally all information needed to start and perform an RBI/RBLM analysis (see ).

Main objective of WP and the Workbook is to describe and specify the use of the RBI/RBLM
methodology practically setting up inspection/testing and maintenance program for power
plants.
The Thematic Network and strong participation of industry partners in the development of the
workbook ensure that the workbook developed in WP4 is to be applied and validated in WP5,
and applied in the demonstration project.
Power Process Chemical

Workbook Workbook Workbook
1 1 1
D4.1 Procedure/Process of RBI/RBLM 2 2 2
Additional details for D4.1 3 3 3
Workbook Part I 4 4 4
5 5 5
6 6 6
Worked Example for D4.1 7 7 7
D4.2 Benchmarking 8 8 8
Additional details for D4.2 9 9 9
10 10 10
D4.3 Deliverable D4.3a D4.3b D4.3c
Item
WB Part II
per
Item
data
OPTIONAL
(Internal RIMAP
deliverables to
participating partners) Appen-
WB Part II
dices
Gloss-
aries...
Figure 2-1 RIMAP Application Workbook for Power Industry structure
2.2 Requirements and scope

The report provides answers to the following requirements/elements of RIMAP project Work
Plan (for the power plan sector):
1. Description of the process of the development of an inspection and main-

tenance program
What: to define the scope of inspection/maintenance for each piece of equipment
according to probable damage mechanisms It includes the definition of the cov-
erage: (% of total equipment, representative equipment, identification of the hot
spots, etc) and the definition of the test points.
How: Selection of inspection/maintenance technique which takes the inspec-
tion/maintenance effectiveness as well as the considered damage mechanisms
into account.
When: to do an action several planning techniques are available and will be de-

scribed (risk criteria. shutdown optimization. regulation, experience and manufac-

turer recommendations).
Documentation: Documentation. In addition the decision logging and data ware-
house like (i.e. “temporal”) storing of the decision-relevant data will be assured
(elements like who, why etc.).
2. Reduce the risk associated to inspection/maintenance program
Apply the consequence (CoF), probability (PoF) and PoD methods defined in WP
3 to:
Evaluate the risk associated with the existing inspection/maintenance program
Define alternative program with an objective of risk reduction, choosing be-
tween replacing, monitoring or testing, and define the way it will be performed
Evaluate and compare alternatives program
3. Optimize inspection/maintenance program through cost with constraint on
safety and environment effects.
Develop workbook per industry sector.

For each of the industries one detailed workbook is to be provided, containing:
default and/or recommended data for typical components needed for calcula-
tion/modeling of
ii. Probabilities of occurrence (PoF-, expert judgments, etc.)
iii. Consequences (safety. financial, environmental, technical, etc.)
1 – 3 completely elaborated examples, including full set of data needed and
explanation of each step in the calculation and interpretation and use of the
results obtained.
Description of limitation and applicability of models and data
The scope of this version of the workbook, concerning main systems is shown in Table 2-1.
All these systems are of course later on, broken down up to component level. In addition
Table 2-1 shows also tackled, selected critical systems/components from process industry
(Giribone, Pocachard, 2003)
Table 2-1 Scope of the workbook concerning main systems

I. Power Industry
Solid fuel systems (e.g. distribution and storage)
Liquid fuel systems (e.g. transport and storage)
Gaseous fuel systems (e.g. transport and storage)
Feedwater/boiler water systems (e.g. boiler water transport)
Boilers (e.g. boiler tubing, headers and drums )
Steam piping (e.g. main steam piping)
Steam turbines (e.g. HP/IP turbine rotors)
Gas turbines (e.g. turbine disks)
Generators (e.g. rotor, stator)
Control systems (e.g. electronics, relays, insulators)
Electric distribution (e.g. switchgear)
Motors (e.g. windings)
II. Process Industry (selected critical systems/components)
Reactor
Heat exchangers
Columns
Furnace
Air – coolers

Drums / Pressure vessels

Filters
Storage tanks
Utility Boiler
Sphere
Piping
Compressors
Pumps
Valves
2.3 How to use this document

As already mentioned, this document incorporates all three foreseen deliverables and due to
practical reasons it is divided into three parts. The idea was to make, on one hand, the use of
the document as simple as possible and on the other, to have one complete document as a
standalone guideline for performing a risk analysis in a power plant.
When using this document, one should first go trough Chapter 3 which gives the overall
guideline on how to set-up and perform a risk analysis. Further chapters give detailed de-
scriptions on some parts of the RIMAP procedure as well as links to other information con-
tained in the workbook (when and if needed).
The following table (see Table 2-2) represents a document “road map” and in a way directs
the user based on the actions he/she would like to perform.
Table 2-2 “Road map” of the document

Action Where to look
Set-up and perform risk analysis See PART I – Chapter 2 which gives guidelines on
a higher level on how to set-up and perform a risk
analysis from start to the end.
Problem and hazard identification See PART I – Chapter 3 which discusses in detail
problem and hazard identification as well as plant
hierarchy, and also points to appendices where
more information can be found
Multi-level risk assessment See PART I – Chapter 4 which discuss in detail one
of the most important steps of the procedure – de-
termination of Probability/Consequence of Failure in
order to assess risk. Gives also links to appendices
where more details can be found
Which data is needed to perform See PART I – Chapter 5 which gives and describes
the risk assessment? the data which can be found in PART II of the work-
book. The data given there thoroughly describes
systems from the plant going deeply to compo-
nent/single problem level

3. RIMAP procedure for power plant components
3.1 General
An overview of RIMAP procedure is shown in Figure 3-1. As may be seen, it has only five
major technical steps, namely
1. preparatory analysis
2. data collection
3. MULTILEVEL RISK ANALYSIS
4. decision making and optimization
5. implementation
Additionally one techno-organizational (incl. economy-related aspects) step, namely
6. Assessment/evaluation of efficiency.
Furthermore, RIMAP procedure is organized as a double cycle: one that is mainly technical
and another that is techno-organizational (management related).
Out of these steps, Multilevel Risk Analysis has one more dimension regarding the depth of
the required analysis. Corresponding levels are:
a. screening (low level analysis)

b. intermediate level (levels of) analysis
c. Detailed analysis.
The respective logical link to qualitative, semi-quantitative and quantitative levels of API, or to
Levels I, II and III of EPRI approach () is intuitive and self-explaining.

Preparatory Analysis
Data collection and

Validation Detailed Analysis
Intermediate Analysis
Screening Analysis
Multi-level Risk Analysis
- PoF
- CoF
- Risk
Seamless, multi-level, transition

Decision making and from screening to detailed
analysis
optimization
- Operation
- Monitoring
- Inspection
- Maintenance
Technical cycle
Implementation
- Operation
- Monitoring
- Inspection
Techno-organizational cycle
- Maintenance
Assessment / Evaluation
of Efficiency
Figure 3-1 Basic representation of RIMAP procedure.
3.2 Standard format for each step

Each step of the procedure is described trough series of sub-steps. The following structure
describes the format for each step.
Each procedure step has following main steps and corresponding sub-steps:
• General
3.2.1 Description
3.2.2 Requirements
3.2.3 Input
3.2.4 Procedure/flowcharts
3.2.5 Output
• Definition of boundaries
3.2.6 Description
3.2.7 Output
• Definition of objectives and scope
3.2.8 Description
• Regulatory requirements
3.2.9 Description and references
• Engineering criteria

3.2.10 Description
3.2.11 Requirements
3.2.12 Input
3.2.13 Warnings, applicability limits
3.2.14 Examples
• Risk acceptance criteria
3.2.15 Description
3.2.16 Requirements
3.2.17 Examples
• Identification of hazards
3.2.18 Description
3.2.19 Requirements
3.2.20 Input
3.2.21 Procedure/flowcharts
3.2.22 Output
3.3 Preparatory analysis
3.3.1 General
3.3.1.1 Description
This step, which is the very first of RIMAP procedure, has the obvious goal to bring us to the
point where we can really begin with the procedure. This means that after the completion of
this step, one should know where to perform RIMAP procedure (i.e. plant, system, compo-
nents, etc.), what he wants to achieve (objectives and scope of the analysis), and a general
idea about how to do it.
3.3.1.2 Requirements
A risk based assessment cannot be conducted in isolation. It is unlikely that a single person
has the width and depth of knowledge to carry out an assessment successfully. A team ap-
proach should and must be encouraged.
Hence, at the very beginning, the team having the needed expertise to accomplish RIMAP
procedure should be composed.
Risk based inspection and maintenance management requires experienced personnel at all
levels as well as appropriate routines for the execution of the work. The current relevant
standards do not set formal requirements to qualification of the personnel that perform in-
spection and maintenance planning, even if the execution of inspection and maintenance ac-
tivities to some extent is regulated through qualification schemes, e.g., ASNT requirements
and European standard EN 473.
Risk based inspection and maintenance planning requires a multidisciplinary team with com-
petencies within
• Inspection and/or maintenance planning requires disciplines engineers,
e.g., mechanical, electrical, instrumentation, and engineers with hands-
on experience from inspecting and/or maintaining the equipment under
consideration both in-service and during construction.
• Inspection planning requiring materials/corrosion personnel with exper-
tise in materials selection, corrosion monitoring and control, chemical
treatments, fitness-for-service assessments.
• Safety/consequence engineers, i.e., personnel with experience in formal
risk analysis covering personnel safety, economic and environmental
disciplines.

• Plant operation, process, and maintenance personnel with detailed

knowledge of the installation and process to be analysed.
• Reliability engineering practise/principles should be available for consul-
tation to ensure that the maintenance activities focus on the high risk
items, to ensure that the maintenance and inspection plan is cost opti-
mised, and more generally to optimise plant operation.
• Inspection expertise depending on the local requirements/legislation.
Note that particular cases may require special competencies. In addition local legislation and
the type of industry may set detailed requirements to competencies involved.
Due consideration should be given to the wide background collated in the team. One or more
of the skills may be possessed by one person, but it is emphasised that risk based inspection
and maintenance planning is a team effort.
The team should then take all appropriate actions so as to assure the acceptance of the
methodology and objectives of RIMAP procedure with owner and authorities (notified bod-
ies).
3.3.1.3 Input
This step receives no direct input from another step. However, it receives a feedback from
the data collection and validation step. In this way, the data collection step is integrated with
the preparatory analysis and the working team can be assured that it has enough data to
proceed with the next steps.
3.3.1.4 Procedure/flowcharts
The preparatory analysis consists of the following sub-steps:
• decide to perform and setup the RIMAP procedure; start RIMAP proce-
dure
• define / limit the system (boundaries) considered for RIMAP procedure
Example: Main steam line piping system from the outlet header to the
turbine inlet (stop valve)
• define objectives
Example: Optimize time and extent of next inspection
• define scope of analysis, including operating conditions, loads and ex-
ceptional situations to be covered (e.g. upsets, accidents, etc.), as well
as the operating period covered
• define risk acceptance criteria, including regulatory requirements
• identify main possible hazards (adverse events)
• identify main damage mechanisms (list)
• identify main possible failure scenarios
• assure acceptance of the methodology and objectives of RIMAP proce-
dure with owner and authorities (notified bodies)
3.3.1.5 Output
The output of this step (i.e. system boundaries, scope of analysis, regulatory requirements,
damage mechanisms, etc.) determines every subsequent step.
3.3.2 Definition of boundaries
3.3.2.1 Description
This is a sub-step of the preparatory analysis and serves the purpose of defining the system
of interest. It can be the plant as a whole as well as a certain component or even a part of it.

It is important to ensure that all aspects are covered, e.g. when considering a pump is it just
the pump impeller and bowl or does it include the drive mechanism, the power source to the
drive. This must be made clear and recorded.
3.3.2.2 Output
The output of this step is a system/component hierarchy in other words a decomposition of
the system of interest in its subsystems (i.e. systems, components, parts, locations). Based
on this hierarchy, one has then to identify the relevant hazards, damage mechanisms, failure
scenarios, etc. (sub-steps of preparatory analysis) and to collect the relevant data (collection
data step).
3.3.2.3 Definition of objectives and scope
3.3.2.4 Description
Time frame for analysis
When considering time dependent degradation mechanisms it is important that the scenario
has a time dimension. This is like posing the question "what is the probability of corrosion
leading to a leak within X years". In choosing the time frame it should be sufficiently large to
cover period where mitigation steps would be possible. A general guide to time frame should
be between 0.5 and 0.7 of the expected remaining life; this time frame for the analysis is
NOT related to the inspection intervals in any mitigation strategy.
3.3.3 Regulatory requirements
3.3.3.1 Description
Scope of this step is the collection of all regulatory requirements that could influence the in-
spection and/or maintenance of the components within the defined boundaries.
3.3.4 Engineering criteria
3.3.4.1 Description
Acceptance criteria are used to compare the results from the risk assessment in order to de-
termine if a scenario is acceptable.
The team must agree what within the context of their industry is considered a failure of an
item of equipment. This activity should be a company issue.
3.3.4.3 Input
Company policy on safety and environment.
National legislation as applicable.
3.3.4.4 Warnings, applicability limits
Financial cost elements are best handled on a cost-benefit basis rather than in the form of
acceptance criteria.
3.3.4.5 Examples

Table 3-1 Examples of engineering criteria for determining a failure.

Equipment Possible failure criteria
Pressure Ves- Localised corrosion leading to leak to atmosphere
sel Environmental cracking - no leak
Insulation damage/ coating failure - no leak
Creep damage to nozzle
Heat exchanger Shell localized corrosion leading to leak to atmosphere
Internal tube leak from one stream to another
3.3.5 Risk acceptance criteria
3.3.5.1 Description
The metric for risk based decisions should be defined via company standards and/or national
legislation. For the process industry in general, three different risk criteria are used:
d. Plant worker safety
e. 3rd party safety (people outside the plant border)
f. Environmental damage, long and short term
The above mentioned risk criteria can be expressed in different units, as shown in Table 3-2
below. Some of the units can be derived from another. The different units are more or less
well suited for use in conjunction with maintenance planning, but it is beyond the scope to
address these issues here. The important aspect is that the overall risk acceptance is ad-
hered to for the local maintenance decisions.
The risk acceptance criteria are used to derive the required maintenance activities within the
given time frame. For degradation mechanisms developing with time, the degradation rate
and acceptance limit provides an upper bound on the time to preventive maintenance or time
to inspection. Also the efficiency of an inspection method for detecting degradation and cov-
erage should be considered.
Table 3-2 Risk Criteria.

Area Name Definition
Safety Individual risk (IR)
Fatal Accident Rate An average risk for a defined group of
(FAR) people.
Defined as number of fatalities per 108
working hours. (Typical values: 1-50)
Societal Risk (SR)
F-N-Curves Defined as number of fatalities and its
probability of occurrence. The shape
of the graph can incorporate conse-
quence aversion.
Environment Volume released per
unit time of given
substance.
Risk presentation
Risk can be presented in different ways, as a time-dependent graph, as a value for the pre-
defined time interval, or as a point in a matrix. Within maintenance planning, risk is best illus-
trated in a risk matrix. Separate matrices are required for each considered type of risk
(safety, health, environment, or economic). Alternatively the scales for different risk types can

be adapted so that they can be presented in the same matrix. Note also that risk matrices will
vary from one plant to another, for example, depending on number of components and the
The matrices should be standardised adapted for each operator/field to simplify communica-
tion and the decision process. To achieve adequate resolution the matrix should not have too
few PoF and CoF classes (at least 4 PoF and CoF classes, respectively). Figure 3-2 shows a
5 x 5 risk matrix. The matrix has probability of failure on the vertical axis, and consequence
of failure on the horizontal axis. The divisions between the categories of each should be cho-
sen taking into consideration the absolute magnitude of the values, their ranges, and the
need for consistent reporting when comparing different plants. For convenience, the risk lev-
els represented by the matrix are divided into zones of equal risk. The zones and thus the
boundaries between the zones must be confirmed in relation to the operator’s risk accep-
tance limits and the local regulator’s limits. One point in the matrix represents one failure
event at a given point in time.
If logarithmic scales are used on the PoF and CoF axis when developing the matrix, the iso-
risk curves will be straight lines. It is also possible to use continuous scales on the axis in
when developing the risk matrix or plot.
Also, a matrix with continuous axis may also be used. In this case the matrix be called a risk
plot.
The risk acceptance limes should be marked in the risk matrix using the relation (2), further
taking into account the part of the risk addressed in the maintenance planning.
Cat Annual, Probability of Failure

-2
5 > 10 expected failure
-3 -2
4 10 -10 high
-4 -3
3 10 to 10 medium
-5 -4
2 10 to 10 low
-5
1 < 10 virtually nil
Consequence category A B C D E
Consequence of Failure
Figure 3-2 Example of Risk Matrix

In order to proceed with a risk based approach like RIMAP procedure, one has to have a
clear idea about the acceptability or not of certain risk levels, since every maintenance deci-
sion depends on them. The scope of this step is to define risk acceptability (and unaccept-
ability) limits.
(According to NORSOK standard Z-013: RISK AND EMERGENCY PREPAREDNESS
ANALYSIS)
Risk acceptance criteria illustrate the overall risk level which is determined as acceptable by
the operator/owner, with respect to a defined period of time or a phase of the activity.
The acceptance criteria for risk constitute a reference for the evaluation of the need for risk
reducing measures and shall therefore be available prior to starting the risk analysis. The risk
acceptance criteria shall as far as possible reflect the safety objectives and the particularities
of the activity in question. The safety objectives are often ideal and thereby difficult to reflect
explicitly.
The evaluations that form the basis for the statement of the risk acceptance criteria shall be
documented by the operator/owner. Distinct limitations for the use of the risk acceptance cri-
teria shall be formulated. Data that are used during the formulation of quantitative risk accep-
tance criteria shall be documented. The manner in which the criteria are to be used shall also
be specified, particularly with respect to the uncertainty that is inherent in quantitative risk
estimates.

The need for updating of risk acceptance criteria shall be evaluated on a regular basis, as an
element of further development and continuous improvement of safety.
In order for the risk acceptance criteria to be adequate as support for HSE management de-
cisions, they shall have the following qualities:
• be suitable for decisions regarding risk reducing measures.
• be suitable for communication.
• be unambiguous in their formulation.
• be independent of concepts in relation to what is favoured by the risk
Unambiguous in the present context implies that they shall be formulated in such a way that
they do not give unreasonable or unintentional effects with respect to evaluating or express-
ing of the risk to the activity. Possible problems with ambiguity may be associated with:
• imprecise formulation of the risk acceptance criteria,
• definition of system limits to what shall be analysed, or
• various ways of averaging the risk.
Another possible problem is that criteria that are principally different may be aimed at the
same type of risk (for example risk to personnel expressed by means of FAR versus impair-
ment risk for main safety functions) may not always give the same ranking of risk in relation
to different alternatives.
Transport between installations shall be included in the risk levels when this is included in the
operations of the installations.
The results of risk assessments will always be associated with some uncertainty, which may
be linked to the relevance of the data basis, the models used in the estimation, the assump-
tions, simplifications or expert judgements that are made.
Considerable uncertainty will always be attached to whether certain events will occur or not,
what will be the immediate effects of such events, and what the consequences will be. This
uncertainty is linked to the knowledge and information that is available at the time of the
analysis. This uncertainty will be reduced as the development work progresses.
The way in which uncertainty in risk estimates shall be treated, shall be defined prior to per-
forming the risk analysis. It is not common to perform a quantitative uncertainty analysis, it
will often be impossible. Sensitivity studies are often preferred, whereby the effects on the
results from changes to important assumptions and aspects are quantified.
The risk estimates shall as far as possible be considered on a 'best estimate' basis, when
considered in relation to the risk acceptance criteria, rather than on an optimistic or pessimis-
tic ('worst case') basis. The approach towards the best estimate shall however, be from the
conservative side, in particular when the data basis is scarce.
3.3.5.3 Examples
Table 3-3 Individual Risk for public.

Authority and Application Limit of unac- Limit of acceptability
ceptability (per (per year)
year)
VROM, the Netherlands 10-6 Not used
(New plants)
VROM, the Netherlands 10-5 Not used
(Existing plants)
HSE, UK 10-4 10-6
(Existing hazardous industry)
ICRP and NRPB, UK 10-4 Not used

Authority and Application Limit of unac- Limit of acceptability

ceptability (per (per year)
year)
(Nuclear industry)
Table 3-4 Individual Risk for Workers.

Authority and Application Limit of unacceptabil- Limit of accept-
ity (per year) ability (per year)
-3
HSE, UK 10 10-6
(Existing hazardous indus-
try)
ICRP and NRPB, UK 10-3 Not used
(Nuclear industry)
Company, Denmark FAR=20 Not used
(Continuously manned plat-
form)
Company, Denmark FAR=40 Not used
(Minimum facilities plat-
form)
Table 3-5 Societal Risk for Public.

Limit of unacceptability Limit of acceptability
Authority (per year (slope in (per year (slope in
and Applica- for one or log/log pres- for one or log/log pres-
tion more fatali- entation) more fatali- entation)
ties) ties)
VROM, the
Netherlands 10-3 -2 Not used Not used
(All plants)
BS EN 1473
(Onshore liq-
10-6 Not defined 10-12 Not defined
uefied natural
gas plants)
French Ad-
ministration
(Refrigerating 0 Not defined Not used Not used
plants using
ammonia)
API RP 580
(example)
≤ 10-3 Not defined Not defined Not defined
(Petrochemi-
cal plants)
Table 3-6 Societal Risk for Workers.

Authority and Appli- Limit of unacceptability Limit of acceptability

(per year for (slope in (per year (slope in

one or more log/log for one or log/log
fatalities) presenta- more fa- presenta-
tion) talities) tion)
BS EN 1473
(Onshore liquefied 10-6 Not defined 10-8 Not defined
natural gas plants)
API RP 580 (example) Not de-
≤ 10-3 Not defined Not defined
(Petrochemical plants) fined
3.3.6 Preliminary Identification of hazards
Note: Preliminary identification of hazards is needed for the Data collection and Validation
step. More detailed, Problem and Hazard identification should be conducted when perform-
ing multi-level risk assessment, see Chapter XXX
3.3.6.1 Description
The four principal factors contributing to hazards and employee loss exposures include the
following:
• Human Factors;
• Situational Factors;
• Environmental Factors; and
• Managerial Factors.
Each of these four factors is discussed below.
Human Factors
The human element is one of the most important contributory aspects to the causation and
avoidance of accidents. Research concerning causes of industrial accidents indicates that
broadly understood human errors, resulting also from organizational inefficiency and man-
agement inadequacy, are determining factors in 70-80% of cases (see Kosmowski, 2000).
It has been often emphasized in safety related works that disasters arise from a combination
of latent and active human errors committed in such areas as design, operations and main-
tenance (see Kosmowski, 2000).
Active human errors refer to an act or failure to act which creates an unsafe condition, which
in turn exposes the employee, co-workers and possibly others to an increased probability
and potential for an accident. Unsafe acts usually result when standard job procedures are
not followed. Some examples of unsafe acts include:
• unauthorized equipment operation;
• using equipment improperly or at too fast a speed;
• operation of equipment or vehicles while chemically or otherwise im-
paired;
• removal of equipment safety guards;
• use of defective equipment;
• lack of or inadequate training;
• lack of or inadequate procedures;
• safety measures bypassed;
• work pressure or adverse supervisor influence;
• poor individual personal attitude toward working safely;
• failure to use protective equipment; and,
• failure to report hazards.

Human error may be significantly reduced by implementing correct methods and procedures;
training for skill proficiency or equipment use; matching physical ability to job requirements;
concentrating on correcting potentially dangerous situations; and by having supervisors cor-
rect unsafe actions by employees.
The characteristic of latent errors is that they do not immediately degrade functioning of the
system, but in combination with other events, which may be active human errors or other
random events in the environment, they give together raise to a catastrophic failure. One can
distinguish two categories of latent errors: operational and organizational. Typical operational
latent errors include maintenance errors, which may make critical systems unavailable or
leave the system in a vulnerable state. Organizational latent errors include design errors,
which give raise to intrinsically unsafe systems, and management or policy errors, which cre-
ate conditions that induce active human errors.
It is therefore obvious that for a successful identification of hazards there is a need of appro-
priate techniques for incorporating human factors and associating them directly with the oc-
currence of accidents, underlying causes or influences.
Situational Factors
Situational factors also contribute to employee loss exposures. Situational factors include,
but are not necessarily limited to:
Defects in Design:
• unguarded equipment;
• poor warning signals;
• ungrounded equipment;
• lightweight metal; and/or
• unvented, combustible flammable materials or containers.
Substandard Construction
• excessive bearing wear on machines;
• ladders with weak rungs;
• metal-cast parts with structural faults;
• warped metal handles; and/or
• missing or ineffective metal connectors.
Improper Storage of Hazardous Materials

• chemical tanks stored in an unstable manner;
• unmarked or unlabeled containers;
• unstable storage cans; and/or
• separation guidelines not followed.
Inadequate Planning, Layout, and Design

• aisles too narrow;
• lights poorly placed;
• welding or painting booth not in protected corner area; and/or,
• combustible materials near excessive heat or sparks.
Environmental Factors
Environmental factors contribute directly or indirectly to potential accident situations. These
include the following three areas:
• Physical - weather conditions, noise, vibration, lighting, temperature, ra-
diation;
• Chemical - chemicals, materials, vapours, fumes, dust, smoke, mist;
and,

• Biological - molds, viruses, fungi, parasites, bacteria.
Managerial Factors
A lack of management commitment and support of the employee safety and health program
may produce several factors that weaken safety efforts, such as:
• inadequate staffing levels;
• inadequate training and education;
• improper responsibility assignment; and
• failure to maintain equipment and tools that are safe and suitable for the
assigned tasks.
Understanding the possible combinations and interactions between human, situational, envi-
ronmental and managerial hazard and accident causation factors helps the agency to identify
and eliminate or reduce the causes of occupational hazards and employee loss exposures.
Employees are in most cases the persons who are closest to potential hazards, and there-
fore are usually in the best position to identify them. Therefore, an effective communications
system must be established for management to encourage input from employees.
Hazards and employee loss exposures may be identified by several different methods.
These methods may include: checklists, inspections and audits, literature search, surveys,
historical accident and claims data, maintenance records, employee suggestions, and safety
hazard identification efforts (what-if review, walk through, HAZOP, FMEA).
Hazard and loss exposure identification should emphasize, but not necessarily be limited to,
the following areas:
• housekeeping practices;
• condition of equipment;
• adequacy of equipment (including personal protective equipment);
• use of prescribed equipment (including personal protective equipment);
• unsafe working practices;
• compliance with policies and procedures; machine guarding;
• qualification of drivers;
• vehicle condition; maintenance of equipment;
• guarding of pits, tanks, and ditches;
• storage and handling of chemicals, flammables, and combustibles;
• fire extinguishers, first aid, and emergency lighting;
• noise and dust levels;
• condition of buildings, grounds, streets, and other infrastructure;
• incident/accident history; and,
• workers’ compensation claims experience.
The information collected concerning hazards and employee loss exposures should be ana-
lyzed for appropriate recommendations to management for developing and implementing a
risk prevention and loss control program.
The group carrying out the hazard identification work should include experts in the various
appropriate aspects, such as design, operation, maintenance and specialists to assist in the
hazard identification process and incorporation of the human element.
3.3.6.3 Input
The identification of hazards has to be related to the defined system boundaries and in ac-
cordance with the scope of the RIMAP procedure. The results of both these steps are thus
considered as input to the hazard identification step.

In general, hazards can be categorized as follows (see Modarres, 1993):
• Chemical hazard (e.g., toxic chemicals released from a chemical proc-
ess)
• Biological hazard (e.g., virus released from pharmaceutical industry)
• Thermal hazard (e.g., high-energy explosion from a chemical reactor)
• Mechanical hazard (e.g., kinetic or potential energy from a moving ob-
ject)
• Electrical hazard (e.g., potential difference, electrical and magnetic
fields, electrical shock)
• Ionizing radiation (e.g., radiation released from a nuclear plant)
• Non-ionizing radiation (e.g., radiation from a microwave oven)
The first step in the identification of hazards is thus the recognition of all of the above haz-
ards that may be contained in the defined system boundaries (see Figure 3-3).
Category of hazard
Recognition of hazards
Chemical hazard
Biological hazard
Thermal hazard Defined system
Mechanical hazard boundaries
Electrical hazard
Ionizing radiation Identifiation of barriers
Non-ionizing radiation that contain the hazards
Identification and
analysis of challenges to
the barriers
Malfunction of process equipment

Wrong operating mode Barrier challenges
Problems with man-machine interface deformation,
Poor design or maintenance
Strength degradation abrasion,erosion,
Adverse natural phenomena Increased stress cavitation, corrosion,
Adverse human-made environment toughness, creep,
fatigue, etc.
internal forces,
elevated temperature
and pressure,
additional loads due to
modified operating
modes, collisions, etc.
Figure 3-3 Procedure for the identification of hazards.

The next step is the identification of the barriers that contain the hazards. Each of the identi-
fied hazards must be examined to determine all the physical barriers that contain it or can
intervene to prevent or minimize exposure to the hazard. These barriers may physically sur-
round the hazard (e.g., walls, pipes, valves, fuel clad, structures); they may use distance to
minimize exposure to the hazard (e.g., minimize exposure to radioactive materials); or they
may provide direct shielding of the subject from the hazard (e.g., protective clothing, bun-
kers) (Modarres, 1993).
The last and most important step is the identification and analysis of the potential challenges
to the identified barriers. Of course, one can also try to identify what is needed to maintain
the integrity of the barriers. In any case, the approach used for hazard identification generally
comprises a combination of both creative and analytical techniques, the aim being to identify
as many relevant problems as possible (IMO, 1997).
The creative element is to ensure that the process is proactive, and not confined only to haz-
ards that have materialized in the past. It typically consists of structured group reviews aim-

ing at identifying the causes and effects of accidents and relevant hazards. Consideration of
functional failure may assist in this process.
The group carrying out such structured reviews should include experts in the various appro-
priate aspects, such as design, operation, maintenance and specialists to assist in the haz-
ard identification process and incorporation of the human element. A structured group review
session may last over a number of days.
The analytical element ensures that previous experience is properly taken into account, and
typically makes use of background information (for example applicable regulations and
codes, available statistical data on accident categories and lists of hazards to personnel,
hazardous substances, ignition sources, etc.). A coarse analysis of possible causes and out-
comes of each accident category should be made by using standard hazard identification
methods (Schlechter, 1995): Literature search, What-if review, Safety audit, Walk through,
Checklist, HAZOP, FMEA.
The challenges to the barriers that contain the hazards are due to the degradation of their
strength and/or high stress in them. Degradation is usually caused by one of the following
situations (Modarres, 1993; Schröder and Lecca, 2000):
• Malfunction of process equipment

• Malfunction of instrumentation and control systems
• Problems with man-machine interface
• Manufacturing problems
• Poor design or maintenance
• Wrong operating mode
• Adverse natural phenomena
• Adverse human-made environment.
3.3.6.5 Output
The output of this step is a list of identified hazards. These hazards should be considered
together with the damage mechanisms that can lead to them in order to establish failure sce-
narios. Moreover, they have to be considered in the determination of consequences step
(sub-step of the multi-level risk analysis).
3.4 Data collection and validation
3.4.1 General
3.4.1.1 Description
The collection and organization of relevant data and information is a mandatory prerequisite
to any form of risk based analysis. The data is used to assess both the probability and con-
sequence (risk) of a failure scenario with analysis method(s) that meet the requirements of
the generic RIMAP procedure. The quality of the data that is available will vary greatly across
industries. Where the data is sparse or of poor quality, the uncertainty associated with the
risk assessment will be greater. This will be reflected in the probability and consequence that
is assigned to a failure scenario.
The data should be collated, verified and stored in a logical database. This will not only facili-
tate the assessment process itself but also the updating and auditing process that are an es-
sential part of the RBI process.

Table 3-7 Information requirements.

Inspection Screening Detailed assessment
Drawings √
Equipment design √
Operating and design conditions √
Operating window (including factors which can be
influenced by the operation and factors that can- √
not be influenced by operation)
Upset conditions √
Susceptibility windows of degradation mecha-
√
nisms
Maintenance and inspection history (incl. current
√ √
equipment state)
Experience with similar equipment √ √
Generic/world data √ √
National/international regulations and codes √ √
Layout drawings √
P&ID √ √
PFD √ √
QRA, Safety case √ √
System description √ √
3.4.2 Design, manufacturing, construction data
3.4.2.1 Description
Simplified/schematic process flow diagrams or operating schemes in order help a pressure
containment boundary. The degree of detail that is required will correspond to size of the
containment boundaries. The data required includes:
• Original construction code / national standard.

• Material of construction/ designation
• Quality assurance/control and testing carried out during fabrication/
manufacture
• Original Design envelope
• General and detailed process/operating description
• Identifiable major hazards/ HSE concerns
3.4.3 Operating and equipment history
3.4.3.1 Description
Review of the operating and equipment history is a key step for any RB assessment. Where
there is no history this increases the uncertainty and hence the probability of failure that is
used in the assessment.
• Details of service / operating history

• Operating environment/ record of major upsets.
• Maintenance and inspection history.
• Details of repairs modification, changes to service / duty.

3.4.4 Generic/equivalent data
3.4.4.1 Description
One of the biggest problems in estimating the probability of failure of a component – or even
worse, the probability of a given scenario – is the usual lack of sufficient data.
To overcome this problem, many companies have co-operated to collect data from plant ex-
perience for a defined group of components. This type of data is usually called "generic" or
"world" data. A number of databases are available; OREDA, IEEE, RAC, T-Book. The stan-
dard ISO 14224 ("Petroleum and natural gas industries - Collection and exchange of reliabil-
ity and maintenance data for equipment") is developed for use when collecting such data.
Most of the generic databases are based on the assumption that the failure rate is shaped as
a "bath-tub" over a component’s lifetime and is divided in three parts, a burn-in, a useful-life
and a wear-out phase. The failure rate is constant during the useful-life phase. If the failure
rate is constant, the time to failure is exponentially distributed. In the generic databases, the
failure rate is usually presented and estimated as λ = n f / t , where nf is the number of ob-
served failures and t is the total operating (or calendar) time. The mean time to failure,
MTTF, is then given by MTTF = 1 / λ .
One problem in the data collection is the quality of such generic databases – or lack of col-
lection of information related to the inspection and maintenance as well as operating condi-
tions for a component. Thus, these data should be used with care, and qualified for use in
each case. Their applicability depends greatly on several parameters (see Table 3-8)
Table 3-8 Component failure database considerations.

Conditions Affecting Component Failure Rates
Industry (same or similar) Process fluid (including chemical con-
trol)
Type of plant (size and fuel type) Manufacturer
Inspection sys- Geographic area (environment and ex-
tem/program/techniques ternal influences) Unique control, proc-
ess, design, etc.
Operation parameters (pressure, vi- Within the same plant/system/train
bration, etc.)
Operating environment (moisture, Size, rating, model, design. etc.
temperature, etc.)
Operating constraints (load following
vs. steady state)
This means that in order to obtain a reasonable probability (or likelihood) one has to modify
the generic data (i.e. to calculate equivalent data) by taking into account all conditions pre-
vailing to the specific problem of interest. (For more information on these issues please refer
to the reports of WP3.)
3.5 Multilevel risk analysis and decision making

Note: this being one of the most important steps in the analysis is described in more detail in
Chapter 4.

3.5.1 General
3.5.1.1 Description
For any risk analysis task, risk is understood as a measure of the potential negative conse-
quences. With this measure one can then make comparisons, which is an essential part of
any decision making (optimization) activity, which is in its turn the reason and goal of any
analysis.
In the current RBMI practice, risk is considered to be the result of consequences and their
respective probabilities. API methodology is calculating risk as the weighted sum of conse-
quences, where the weights equal their respective probabilities. Although this is not the only
way to define risk, it divides the problem of risk evaluation in two simpler ones: The identifica-
tion of all potential consequences and the determination of their probabilities.
At this point, a serious methodological problem arises. To proceed with the solution of the
above mentioned problems there is a need of data that in most cases are partly known or
even unknown. In other words, there is a lot of uncertainty. Moreover, information gathering
is not for free since it costs at least time and effort. The proposed solution to this kind of
problems is to proceed with a level approach.
The level approach
The philosophy of the level approach is very simple and intuitive. At a first stage, usually
called screening, one makes rough estimates of the consequences and their probabilities. In
an RBMI process, the alternatives of the risk analysis can be components and with this
screening procedure one can prioritize among them.
In the next stage, and based on the priorities derived from screening, one can decide about
the problem of gathering or not more data for a specific component, the kind of data to
gather, etc. Candidates for a more detailed analysis are thus components that were highly
ranked. To avoid overlooking of a component that is not ranked very high but could eventu-
ally have a very serious consequence of a certain type (e.g. on economy, safety, etc.) one
can even flag these components so as to consider them too.
Multi-level approach
It is obvious, that if there exists a strict regulation determining the inspection of a certain
component, there is not even a need for screening let alone for a detailed analysis. This
clearly shows that we can not consider the level approach separately from the actual deci-
sion making options. In other words, the benefit of going into a more detailed analysis of a
particular component has to be correlated with the inspection (or more generally, mainte-
nance) options for this component.
This is only possible if we already have knowledge about the possible inspection methods we
could use in each case, i.e. for each component. In case this is not possible, we can only use
a traditional level approach. Therefore, for the needs of the new approach, this knowledge is
assumed as known.
The first issue that this new approach reconsiders is the notion of uncertainty, and particu-
larly the modeling of the uncertainty. Instead of looking for rough estimates of the conse-
quences and their probabilities, one also has to model the uncertainty of the estimates by
giving a lower and an upper bound of them. The first stage is then performed as before, only
it gives no point estimates for risk but areas (i.e. in a risk matrix, every component is repre-
sented by an area).
The next step, the determination of the required level (depth, detail) of the analysis, is now
much easier to grasp. One has to compare the inspection (maintenance) options correspond-
ing to the best and worst case of each component and act accordingly: In case there is no or
little difference a more detailed analysis can not be justified. In case of a clear difference, one

can concentrate on first collecting this kind of data that could reduce the part of the uncer-
tainty that most contributes on this difference, e.g. the uncertainty in the estimation of the
consequence or in the estimation of its probability. The level of the analysis is therefore com-
ponent dependent and we can speak of a multi-level approach.
Although, the above mentioned approach looks very promising, there is an inherent difficulty,
namely the correlation of the risk level of a component with a predefined set of inspection
(maintenance) options. However, since the inspection options are correlated with the general
condition of a component, the risk level has to be correlated with the general condition of the
component. With the later development of the damage mechanism analysis modules we ex-
pect that this correlation will be greatly facilitated.
3.5.2 Risk screening
3.5.2.1 Description
The purpose of the risk screening is to prioritise work by reducing work effort on low risk
items and increasing the effort on the high risk items. The risk screening will divide the sys-
tems and groups of equipment into two groups: high risk items and medium/low risk items.
The high risk items require the detailed analysis described in section 3.5.3. The low/medium
risk items only require minimal surveillance to verify and ensure that the assumptions made
during the screening process remain true. This could for example amount to verify the condi-
tion of the coating.
Risk screening is a team effort. It is therefore essential that the competencies in section
3.3.1.2 are present during the screening. The risk screening requires 1-2 days work for a
process system consisting of approximately 30.000 tags (valves, instruments, pieces of pip-
ing) or about 500 maintainable items.
The workflow for risk screening is given in Figure 3-4.
RBMI Risk Screening
Risk Screening
Systems and Session
Components in -POF Plant knowledge
SoW -COF Degradation
- Risk knowledge
Risk
Acceptable
Y N
Lack of key Info
Minimum Detailed
Surveilance Assessment
Figure 3-4 Risk screening.

If information is missing during the screening such that the risk associated with the equip-
ment cannot be determined, the equipment should be regarded to have a high risk and reas-
sessed during the detailed assessment in section 3.5.3.
Risk screening consists of the following steps:
• Identify hazards.
• Determine likelihood / probability of failure.
• Determine consequence of failure.
• Determine risk and classify equipment as high, medium ,or low risk.
• Rating criteria must be defined and recorded in writing.
• The likelihood/probability must be established for a given (predefined)
time frame based on a prediction of damage development for operation
within specified operating window. The specified operating window
should include both factors which can be influenced by the operation of
the process (e.g. temperature, pressure) as well as factors which cannot
be influenced by the operation (e.g. composition of the process me-
dium).
• The results from the Risk screening must be conservative compared to
those from a Detailed analysis. One option to demonstrate conservatism
is by executing both types of analysis for a certain number of compo-
nents, e.g. 10% selection at random.
• In order to assess the Consequence, at least the aspects Safety, Health
and Environment must be included. In addition, the Consequence rating
must be such that the highest rating for one of the individual aspects
(Safety, Health, Environment and/or financial consequences) must con-
trol the final score (so no averaging of aspects).
• The methodology must be validated.
• This task should be performed by RBMI team (see preparatory analy-
sis).
• The results should be auditable to similar experts (peer review); there-
fore, the methodology, the input data, the decision criteria and the re-
sults must be documented (the results must be recorded in an author-
ized document).
3.5.2.3 Input
The following information is needed:
Identify hazards
• Input from preparatory analysis
Determine likelihood / probability of failure
• The predefined time frame (from preparatory analysis)

• Maintenance and inspection history of the item of equipment under con-
sideration.
• Specification of the operating window including both factors which can
be influenced by the operation of the process (e.g. temperature, pres-
sure) as well as factors which cannot be influenced by the operation
(e.g. composition of the process medium).

• Inspection data on the damage development so far

• Experience with similar equipment, e.g. average probability data from a
relevant database.
• A methodology that defines rating criteria.
Determine consequence of failure
• The composition of the contained fluid and its physical/chemical proper-

ties
• The pressure, temperature and total amount of fluid available of release
• A methodology that defines rating criteria, at least aimed at the impact
on Health, Safety and Environment. If no further input data are used
(than the abovementioned data), the criteria must result into a conserva-
tive rating compared to a more detailed analysis.
• Depending on national regulations more data, e.g. the final phase of the
fluid on release into the atmosphere, the dispersal characteristics of the
fluid at the site, mitigation systems such as water curtains, measures for
detection of the leak/break.
• If it is desired to include the potential leak/break area then the failure
mode and the pipe/vessel size must be entered.
• If it is desired to include business impact then the financial effect of pro-
duction loss as well as repair/replacement costs must be entered.
• If it is desired to include publicity damage then a financial value must be
entered expressing the negative effect on future business.
Determine risk and classify equipment
• Risk acceptance criteria (input from preparatory analysis)

Identify relevant hazards

The purpose of this task is to identify the relevant hazards for each system within the
boundaries of the scope of work (SoW). The known operating conditions, upsets, likely ex-
cursions, as well as future process conditions should be taken into account when determin-
ing if degradation and/or failure is likely to occur.
Determine likelihood / probability of failure

For each hazard identified in each system, the PoF should be assessed. The PoF should be
determined for the pre-defined time frame. The estimate should be conservative and based
on the available information and expert judgement.
When the PoF has been determined, it should be assessed whether the PoF is high or low.
This amounts to determining whether the PoF is higher or lower than a predefined limit.
If this is difficult set PoF equal to 1 and perform a consequence screening.
Determine CoF
The worst possible outcome of a failure should be established. The safety, health, environ-
ment, and economic consequences shall be considered. Other consequences as quality of
production and business may also be included.
When the CoF has been assessed it should be decided whether it is high or low, depending
on whether the CoF is above or below a predefined limit. Possible limits are
• Safety consequences: Any failure which may lead to injury of personnel.

• Environmental consequence: Release of toxic substances.

• Economic consequence: any failure leading to production stoppage.
Determine risk and classify equipment

Based on the hazard identification, PoF assessment, and CoF assessment, the equipment
should be grouped into high and low risk systems or groups of equipment. PoF and CoF
should be presented / expressed not only as a combined risk value or category but also
separately.
Based on the screening results the systems or groups of equipment should be given a low,
medium or high risk. Systems or groups of equipment with a high risk should be considered
during the detailed assessment. Systems of groups of equipment that have medium risk
should be considered for maintenance. Finally, for the low risk systems or groups of equip-
ment the assumptions should be periodically checked. This may amount to verifying that the
basic assumptions are satisfied, e.g. coating is satisfactory or that the operating conditions
remain unchanged. For low risk systems minimum surveillance is required. Medium and high
risk systems should be considered in the detailed analysis. In any case, regulatory require-
ments should also be taken into account.
Figure 3-5 proposes maintenance and inspection activities for systems based on their risk
rating.
Probability Risk categories and screening

5 High probability Medium risk High risk
4 of failure Maintenance can be used to Detailed analysis of both
reduce risk, but is unlikely to consequence and prob-
3
be cost-effective; the cheap- ability of failure
2 est solution is often to carry
out corrective maintenance
upon failure
1 Low probability Low risk Medium risk
of failure Minimum surveillance, with Consequence is high so
corrective maintenance of inspection and preventive
failures. Check that assump- maintenance should be
tions used in the damage considered to ensure low
assessment remain valid, probability. Apply cost
e.g., due to changes in op- benefit assessment.
erating conditions, condition
of coating
Consequence A B C D E
Negligible/low conse- High consequence
quence
Figure 3-5 Screening Risk Matrix
The main purpose of the risk screening is to identify the low risk items in category A1 and
remove them from further analysis. It is very important that not too many components are
placed in category A1.
How do we ensure that this does not happen?
• Ensuring that the acceptance criteria and probability and consequence

classes are adapted; and that

• limit between low and high probability of failure and consequence of fail-
ure are well defined;
• Ensure that these limits are used during the screening.
3.5.2.5 Minimal (adequate) measures
For low risk systems (minimal adequate) measures to control the integrity the equipment
shall be defined. The purpose is to verify that the assumptions made during the risk screen-
ing remain valid. Eventually, it may be concluded not to perform any measures or to minimise
the measure allowing a high probability of failure.
The measures should be in line with generally accepted industry practice and must meet na-
tional regulatory requirements.
3.5.2.6 Output
Typical results from these tasks are:
• A PoF value or category for the piece of equipment under consideration.

• A CoF value or category for the piece of equipment under consideration
Note that PoF assessment usually requires more detail and is therefore more cost intensive
than CoF assessments. Therefore some prefer to screen systems and groups of components
on consequence of failure only. This is also acceptable, even if the example below suggests
another type of screening.
3.5.2.8 Tools
In the field of RBI, a number of commercially available methodologies exist, each including a
Risk screening module; see RIMAP Report on Current Practice.
3.5.3 Detailed analysis
3.5.3.1 Description
The Detailed analysis is aimed at establishing an inspection programme based on combina-
tion of expert opinion and appropriate quantitative analysis set down in writing, e.g. (at least)
trending of inspection data.
The detailed assessment may require between 2 and 18 man-months for a topside process-
ing system with approximately 30.000 tags (valves, instruments, pieces of piping) or 500
maintainable items. The total work volume depends on to what extent personnel from the
plant are involved in the maintenance and inspection planning. It typically takes 2 to 4
months to complete the task.
It consists of the following tasks:
• Construct equipment hierarchy

• Identify relevant damage mechanisms and failure modes
• Determine likelihood / probability of failure
• Determine consequence of failure
• Consider conservative inspection / maintenance
• Assess risk
• Construct decision logic
• The analysis of failure modes enhances the level of detail to assess the
consequence of failure. If it is not undertaken, a conservative approach

must be followed. A conservative approach may be the assumption that

the complete content of the containment may escape instantaneously.
• Rating criteria must be defined and recorded in writing.
• The likelihood/probability must be established for a given (predefined)
time frame based on a prediction of damage development for operation
within specified operating window. The specified operating window
should include both factors which can be influenced by the operation of
the process (e.g. temperature, pressure) as well as factors which cannot
be influenced by the operation (e.g. composition of the process me-
dium).
• The assessment of PoF in a detailed analysis must be based on the
value of expected residual lifetime as well as a weighing system/factor
to take account of the uncertainty of prediction. The prediction of lifetime
may result from one of the following options: measured inspection data,
a calculation making use of operating conditions, expert opinion. If so
desired, specific analysis tools may be used, e.g. probabilistic (safety)
analysis and/or fitness for purpose analysis.
• For all non-trendable degradation mechanisms (degradation mecha-
nisms of which progress can not be monitored properly or which pro-
gress can not be predicted properly, e.g. stress corrosion cracking), it
should be demonstrated that they are prevented or early detected by
means of sufficient measures to be taken (inspection, maintenance, op-
eration). A methodology should be available in which the relation be-
tween the effectiveness of measures (type, scope and frequency) and
Likelihood / probability of failure is given.
• In order to assess the Consequence, at least the aspects Safety, Health
and Environment must be included. In addition, the Consequence rating
must be such that the highest rating for one of the individual aspects
(Safety, Health, Environment and/or financial consequences) must con-
trol the final score (so no averaging of aspects).
• The methodology must be validated.
• The task should be performed by RBMI team (see preparatory analysis).
• The results should be auditable to similar experts (peer review); there-
fore, the methodology, the input data, the decision criteria and the re-
sults must be documented (the results must be recorded in an author-
ized document).
3.5.3.3 Input
3.5.3.4 Identify relevant damage mechanisms and failure modes
• Operating and design conditions

• Upset conditions
• Susceptibility windows of degradation mechanisms.
• Characteristics of potential degradation mechanisms, e.g.: local or over-
all degradation, possibility of cracking, detectability (in early or final
stage).
• Mechanical loading conditions
• Geometry of piece of equipment
3.5.3.5 Determine likelihood / probability of failure

• The predefined study period (from preparatory analysis).

• The specified operating window, which should include factors that can
be influenced by the operation of the process (e.g. temperature, pres-
sure) and factors that cannot be influenced by the operation (e.g. com-
position of the process medium).
• Plant specific experience (data or soft knowledge).
• The PoF assessment in a detailed analysis must be based on the value
of expected residual lifetime as well as a weighing system/factor to take
account of the uncertainty of prediction. The prediction of lifetime may
result from one of the following options: measured inspection data, a
calculation making use of operating conditions, expert opinion. If so de-
sired, specific analysis tools may be used, e.g. probabilistic (safety)
analysis and/or fitness for purpose analysis.
• For all non-trendable degradation mechanisms (degradation mecha-
nisms where progress cannot be properly monitored or properly pre-
dicted, e.g. stress corrosion cracking), it should be demonstrated that
degradation is prevented or detected early by means of sufficient meas-
ures to be taken (inspection, maintenance, operation). A methodology
should be available in which the relation between the effectiveness of
measures (type, scope and frequency) and probability of failure is given.
3.5.3.6 Determine consequence of failure
The consequence assessment requires (depending on application) the following input:
• Characteristics of the relevant degradation mechanisms, e.g.: local or

overall degradation, possibility of cracking, detectability (in early or final
stage).
• If containment is considered, the composition of the contained fluid and
its physical/chemical properties, the pressure, temperature and total
amount of fluid available of release shall be available. To obtain satis-
factory CoF assessments may in this case often require to defining a
number of scenarios, e.g., small leakage, large leakage, and full rupture.
• Characterisation of mitigating systems (water curtains, detection and
warning systems, monitoring, etc.) During the safety, health and envi-
ronmental CoF assessment credit may only be taken for passive mitigat-
ing systems.
• Consequences should also be assessed for hidden failures and test in-
dependent failures.
• Depending on national regulations more data, e.g. the final phase of the
fluid on release into the atmosphere, the dispersal characteristics of the
fluid at the site, mitigation systems such as water curtains, measures for
detection of the leak/break.
• If it is desired to include the potential leak/break area then the failure
mode and the pipe/vessel size must be entered.
• If it is desired to include business impact then the financial effect of pro-
duction loss as well as repair/replacement costs must be entered.
• If it is desired to include publicity damage then a financial value must be
entered expressing the negative effect on future business.

Detailed Assessment
High Risk
Components from
Screening
Equipment Hirarch Functional Hirarcy
Functional
System Sub- Description
Components functions
Parts
Failure Mode
Degradation
Mechanisms
FMEA: Failure Mode Effect Analysis
Consequence of
Probability of
Failure Risk
failure assessment
assessment
Decission Logic.
Risk Acceptable, Strategy
Cost effective
Modification of
Corrective Time based Condition Based
Functional Testing System/
Maintenance Maintenance Maintenance
component
Strategy and Maintenance Plan
Figure 3-6 Detailed assessment
3.5.3.8 Construct equipment hierarchy

The purpose of the first step is to, if necessary, divide the system under consideration into its
individual components as well as to collect information on process-service/material damage,
design, operation history, and damage mechanisms. The level of detailing should be chosen
with care to ensure that all the relevant damage mechanisms are considered, at the same
time as the scope of work is limited as much as possible. The level of detail also depends on
the level of detail required to perform the inspection/maintenance planning as well as the
amount and the quality of the available input data. The level of detailing is usually increased
for high risk components. The analysis should start at system level and proceed to tag or
maintainable item level.
To simplify the detailed assessment, it is recommended to define groups of components so

that analysis done for one component can be applied to the other components within the
same group. Corrosion circuits and pumps operating under similar conditions are examples
of component groups. Different component groups can be defined for CoF and PoF assess-
ments. P&ID’s and PFD can for example be used to document the picture.

A number of tools can be used for identifying hazards. In this case it is recommended to
carry out a system level FME(C) analysis. A number of standards for FME(C)A are available:
• IEC812 (1985) Analysis techniques for system reliability – Procedure for

failure mode and effects analysis (FMEA)
• MIL-STD-1629A (1980) Procedures for performing failure mode, effects
and criticality analysis.
• etc.
There are also a number of software tools that can support FMECA analyses.
3.5.3.9 Identify relevant damage mechanisms and failure modes
The purpose of this task is to identify the relevant degradation mechanisms and failure
modes. This is a group activity that requires that the competencies in section 3.3.1.2 are pre-
sent or can be consulted. A number of techniques can be used to identify the hazards. We
recommend that a FME(C) analysis is applied, but HAZOP, HAZID, Check-lists, FMEA,
FMECE, Check-lists, or What-if analysis, or experience from similar facilities can also be
used alone or to supplement the FME(C)A . If previous analyses exist, the results from these
can be used as input in to this task.
The information identified in Table 3-7 shall be available during the identification damage
mechanisms and failure modes.
3.5.3.10 Determine probability of failure
The current probability of failure and the PoF development over time shall be assessed for all
relevant degradation mechanisms. The development of the PoF over time is an important
parameter to consider when the maintenance/inspection strategies and intervals are deter-
mined later in the analysis. The probability of failure shall also be linked to the appropriate
end event in the bow tie model to ensure that each consequence is assigned the correct
probability of failure. In addition the uncertainty in the PoF assessment shall be determined.
The methodology specifies the criteria and numerical routines which take into account the
following factors:
• the relevant degradation mechanisms

• loading by the future operating conditions compared by the past operat-
ing conditions
• the impact of operating conditions on the susceptibility of the potential
degradation mechanisms (both the probability of initiation and the effect
on progress)
• calibrate the PoF model with inspection data or past experience.
• The damage development based on extrapolation of inspection data
from past.
• Combination of the individual PoF ratings for each potential degradation
mechanism to an integrated value or category for the piece of equip-
ment under consideration.
3.5.3.11 Determine consequence of failure
The safety, health, environmental and economic consequence of failure (CoF) shall be as-
sessed for the relevant degradation mechanisms. Other consequences, e.g., to quality of the
product or business risk, may also be considered. Note that the risk is usually not reduced by
mitigating the consequences, but by mitigating the PoF. Scenarios (sequence of events) and
event trees shall be established to enhance the accuracy of the consequence assessment

for serious events. The event tree must be developed or adapted to the particular application
at hand. Event trees can be found in QRA’s, safety cases, or published literature. The con-
sequence of failure shall also be linked to the appropriate end cause in the bow tie model to
ensure that each end event is assigned the correct probability of occurring. This is only done
for the most reasonable scenarios. In addition the uncertainty in the CoF assessments shall
be determined.
3.5.3.12 Consider conservative inspection/maintenance
Conservative inspection/maintenance is an efficient method for defining an inspection and/or
maintenance program, if the mitigating actions are cheap compared to developing an opti-
mised maintenance/inspection plan. Conservative maintenance/inspection programs are ob-
tained using conservative PoF and CoF assessments, that require little work effort, as a ba-
sis for defining the mitigating activities. Uncertainties in the analysis shall be assessed.
The information listed in Table 3-7 is required for developing a conservative mainte-
nance/inspection plan. Note that developing a conservative inspection/maintenance program
places particular responsibility on the personnel involved and their competencies, see sec-
tion 3.3.1.2, to ensure that the risk is acceptable after conservative inspection has been car-
ried out.
It consists of the following steps:
• Select the highest level of effectiveness for inspection.

• Calculate the resulting PoF taking account of eventually demonstrated
degradation.
• Check whether the resulting mitigated Risk is acceptable taking into ac-
count the CoF level from the Risk screening.
The output from this task should be a highly effective inspection programme.
3.5.3.13 Risk assessment
When the PoF and CoF has been assessed, the safety, health, environment, and economic
risks and economic risks shall be determined. The results can be plotted in risk matrices for
presentation and comparison. Separate matrices should be used for each risk type unless it
is relevant to compare the risk types
Note that the risk matrix presents the risk for a predefined time period. If the risk for other
time periods or the development of risk over time is of interest, additional risk matrices
should be used.
The risk results should be compared with other related studies if available, e.g., QRA’s and
safety cases.
3.5.3.14 Decision logic
If the risk is found to be unacceptable (compared with the objectives defined in Section 6.2.1)
mitigating strategies shall be defined.
The decision logic is a structured method for deriving maintenance and inspection strategies.
Figure 3-7 illustrates an example of a decision logic. It is not compulsory to use the decision
logic to derive maintenance strategies. Note that the first column in the decision logic ad-
dresses some aspects that are also addressed in Table 3-9.

Cause, Criticality and Operational Failure Failure

Cost Efficiency Detectabilty Characteristics Strategy
Maintenance
1 11
Can failure cause Implement:
be cheaply procedure
Y
identified and is modification
elimination clearly 7 operating
cost effective? Is failure 9 condition
mechanisms/ Can hidden failure 12
Y cause known and be det-ected by Y
N Regular funcitonal
detectable to sched-uled tests testing/inspection
2 5
N Operator or inspection?
Is failure risk low Is operational
Y maintenance Technician/
for safety and N 13
applicable and Responsible
environment? Person? Time based
effective? 10 maintenance
Has component Y
Y N N Y (running hours
Y predictable age? or calander
3 based PM)
Is failure risk low 6 8
Y Is development of N 14
for production and Does Operational Implement:
follow cost? Maintenance filfill failure machanism
dectable by: N - modification
requirements for - oper.procedure
Y preventive y NDT
y Installed CM - task combination
maintenance?
4 methods 15
Is PM more cost y Analysis of Y Condition based
effective than process Maintenance
CM? data
16
NDT
Inspection/NDT
17
Y Operational
Maintenance
18
Corrective
N
Maintenance,
Run to failure.
PM: Preventive Maintenance
CM: Corrective Maintenance
NDT: Non Destructive Testing/Inspection
Figure 3-7 Decision Logic.
Some typical examples illustrating the application of the decision logic are presented below:
Table 3-9 Examples of decision logic application.

Case Decision route
Corrosion under insulation for Screened as high risk.
a pipe 1 to 11 in case less expensive painting can be
done
1, 2, 5, 7, 8, 16. I.e. Regular Inspection
Stress corrosion cracking of a 1, 2, 5, 7, 9, 12: Testing/inspection
pressure vessel 1, 2, 5, 7, 9, 10, 14: No inspection possible
Maintenance of a gas de- 1, 2, 5, 7, 9, 12: I.e. regular testing of function at
tector given intervals. Intervals to be set by reliability
requirements.
Maintenance of a bearing of 1, 2, 3, 5, 7, 8, 15: Failures can be detected by
a rolling mill CM and scheduled accordingly.
When the maintenance/inspection strategy has been determined, the method, intervals, and
extent of inspection must be determined such that risks remain acceptable and costs are op-
timised. This is achieved by establishing risk reduction measures for each maintainable item.
The risk reduction effect of alternative measures as well as the costs of these measures

should be determined. The method should be chosen based on cost optimisation subject to
the boundary condition that the safety, health, and environmental risks satisfy the accep-
tance criteria defined in section 3.3.4.
3.5.3.15 Output
Typical results from these tasks are:
• A PoF value or category for the piece of equipment under consideration.

• A CoF value or category for the piece of equipment under consideration
Not Applicable
3.5.3.17 Tools
In the field of RBI, a number of commercially available methodologies exist, each including a
detailed analysis module; see RIMAP Report on Current Practice.
3.5.4 Multilevel analysis
3.5.4.1 Examples
E/J E/J
Expert Direct PoF’ Expert’s PoF/LoF
Judgment Input Basic PoF/LoF estimate Correction
H/S
Input
Statistical analysis
of Historical data
F/M
Prediction of
possible Future
behavior based on
analytical and other
Models
Input
Data: failures, operation, loads, materials,

Input
geometry, plants, inspection…
Figure 3-8 Example of PoF (LoF) calculation.

Plant Cause 1
Plant E E1
AN D Yes
Cause 2 PROBLEM /
PROBLEM / E E2
ISSUE
System AND ISSUE
Bow tie
Failure
System Bow tie
“Scenario”
Cause 3
“Scenario”
OR E E3
Cause 4
Component E E4
Component
PROBLEM /
PROBLEM
ISSUE #1 /
ISSUE #1
Scenario
Scenario
Damage
mechanism
- fatigue
Consequence evaluation
- health & safety
- environment
- economics
Modules, tools
PROBLEM /
PROBLEM
ISSUE #2 /
- fatigue
ISSUE #2
Scenario - creep
Scenario - failure
Damage
mechanism
- creep Modules, tools
- health & safety
Consequence evaluation - environment
- health & safety - economics
- environment
- economics
Figure 3-9 Example of PoF (LoF) issues in practice (power plant).
3.6 Implementation of plans
3.6.1 General
RIMAP Risk Based Inspection and Maintenance planning considers two phases in the In-
spection and Maintenance planning:
Phase 1: Development of the I&M plan, and

Phase 2: Execution of the I&M plan.
3.6.2 Development of the I&M plan
3.6.2.1 Description
Determine the (cost) effective inspection and maintenance strategy based on the Risk Analy-
sis (PoF x Consequence) for each failure mode per maintainable item to achieve the desired
Risk Level.
A maintainable item can either be a system, equipment or component. The level of detail for
the maintainable item is preferably in line with the actual situation how inspection and main-
tenance teams keep track of data for their activities and history data logging based on sound
practice.
To be able to develop an effective I&M plan a structured approach is needed for required in-
put, experts to consult and for output.

The combination and cooperation of experts contributes highly to the quality and capability of
the I&M plan.
The input needs will include but is not limited to the following areas of expertise: Risk (PoF x
Consequence) but also input from Operation, Process, Maintenance, Historical Data and De-
sign input.
The output of an I&M plan is the input for the planning and scheduling for all involved de-
partments, disciplines and contractors of the inspection and maintenance work for the facility
and its maintainable items.
The output of the development of the I&M plan will be based around a maintainable item and
will have a broad variety of strategies such as the elimination of the risk or item, monitoring,
performance testing, improvement of procedures for process, operation and/or maintenance,
inspection, modification, repair, replacement, or operate to failure.
Knowledge and Experience
The development of the I&M plan will be done by a team or person meeting the following
qualifications:
• Sufficient knowledge of Risk levels, PoF and Consequences and quali-

fied knowledge of the Maintainable items considered.
• Experience with the facility and the maintainable items to inspect. Gen-
erally several years of familiarity with the operation and maintenance of
the facility is required.
• Access to all relevant data and Risk Analysis. More details are men-
tioned in the paragraph: Inputs.
Input
The actual Risk Level and the Desired Risk level.
For details see paragraph: Inputs.
Output
The output should be presented in a way that the planning and scheduling of inspection and
maintenance activities can be achieved and fits in the company’s procedures for the execu-
tion by all departments, disciplines and contractors.
Tracebility
The I&M plan will be uniquely related to the maintainable item(s), originator and will be dated.
Risk level relation

The I&M plan will contain all relevant details on the strategy level for execution in order to
obtain the desired reduction of level of Risk as set by the RBMI analysis and process.
Actuality
The I&M plan will be reviewed and updated directly after inspection and maintenance are
executed for effectiveness, completeness and future use of the I&M plan.
3.6.2.3 Input
Desired Risk level by:

• Risk information out of the RBMI analysis (PoF and Consequence). PoF
is particularly important for Inspection and Maintenance information at
the level of a maintainable item such as:
Degradation mechanism
Failure mode
Trendable or Non trendable failure development
Actual Risk Level by:
• Inspection and Maintenance data
Historical data on damage and deterioration and its associated
failure analysis, including details of causes and actions to re-
solve, to prevent, to predict and/or to monitor.
Historical data on inspection, tests and trends thereof.
Historical data on executed repairs, replacements, modifica-
tions.
• Actual general verification of condition (“so called pre-inspection”)
Field examination for information and verification of the actual
status of the Maintainable item (System, equipment or compo-
nent) by visual inspection and obvious to do NDT organized
and/or executed by a qualified inspector.
• Design Condition
Design conditions on the level of the Maintainable item (System, equip-
ment or component) such as:
Specifications (materials, welding )
Drawings (dimensions, construction )
Procedures (installation-, operation- and maintenance instruc-
tions)
Manufacturing data (actual data on used materials, welding de-
tails, examinations and tests performed)
• Process data
Information of process data such as:
Product specifications
Product variability
Out of specification product events
• Operation data
Information of operation data such as:
Normal Operation window, design criteria (temperature, pres-
sure, flow)
Deviation of normal window of operation, consequences and in-
vestigations thereof.
• Outside influences
Extreme atmospheric conditions e.g. severe storms, flooding,
land slides, land sinks, tornados, hurricanes, earth quakes.
Extreme surrounding conditions e.g. fires, pressure waves, ex-
plosions, deflagration, and detonation.
Gather Input data
Field examination (pre-inspection)
Development phase of strategies by study of inputs and field examination
Output generation of strategies per maintainable item
3.6.2.5 Output
Strategy per maintainable item

The output of development of the I&M plan will be a strategy per maintainable item to
achieve the desired Risk Level.
The type of output to be considered for an item will be one of the following possibilities. Typi-
cally the following sequence represents the order of preferred solutions:
a. Elimination or minimization of the risk (by obvious change, replacement if

possible)
b. Condition based inspection and maintenance e.g. NDT plan or monitoring
c. Time based inspection and or maintenance, calendar or operation time
based e.g. NDT plan, lubrication etc.
d. Regular performance testing (e.g. for hidden failures, typical for protective
devices and instruments)
e. Modification of procedures and/or improvement of discipline (human factor)
for process, operation and/or maintenance.
f. Corrective maintenance e.g. operate to failure
g. Repair, Modification or Replacement of item
Inputs for generation of an I&M plan are broad in variety. The quality and capability of the
output of an I&M plan highly depends on these inputs. The inspector in charge or depending
the organization structure the management for the development of the Inspection and Main-
tenance plan plays a key role. The way the entire organization is able to achieve the full co-
operation and support of the functions operation, process, maintenance and other experts to
detail the item characteristics, highly influences the quality and capability in the development
phase the execution of the plan.
3.6.3 Examples
Expert systems like DMI. Dialog Modular Inspection Plans.
DMI is a program to build a company’s Expert System for Inspection plans by sequence of
process function, type of maintainable item and type of strategy.
DMI guides inspection experts through most relevant questions on the maintainable item
while in the meantime the program is generating the inspection and maintenance plan for the
item.
3.6.4 Execution of the I&M plan
3.6.4.1 Description
Execute the activities for the maintainable item in the inspection and maintenance plan to
achieve the desired Risk Level.
Per maintainable item (system, equipment or component) the actions with the skill levels re-
quired and resources needed will be planned and scheduled.
These actions will be processed as work-orders to the inspection and maintenance crews
internally or to service-contractors.
Evident failures, deviations or deterioration’s found during the execution of the actions need
to be addressed to the responsible inspector and maintenance team for follow-up action.
The follow-up action will vary in nature such as:
a. Immediate action e.g. repair, replacement

b. Future action e.g. planned repairs, planned replacements
c. Review of data for updated (future) strategy
d. Address lack of Risk reduction against the Desired Risk Level to the re-
sponsible organization.

The primary objective of the Execution of the I&M plan will be to achieve the new acceptable
level of Risk (PoF x Consequence). In most cases only the PoF level will be reduced to
achieve the new Risk Level. Typically the Consequence will not be influenced. The Conse-
quence is often inherent to the concept of design.
Where a sufficient Risk reduction is not achieved future actions or reviews should be ad-
dressed to the organization for follow-up action.
The execution of the I&M detailed activities will be done by:
a. Skilled and trained people
For each skill an education, experience and qualification level should be
defined.
Measurements will be the main output of the I&M plan detailed activities.
On the basis of the measurements the Qualified Inspector will inspect

against criteria set by RBMI and design conditions.
In cases where assessments have to be made outside the competence of the Qualified In-
spector, the Qualified Inspector will inform and organize the experts needed for full assess-
ment of the findings and measurements.
The experts may be from different disciplines: Design Engineering, Operation, Process Engi-
neering, Maintenance, Material- or NDT specialists or Outside Experts where deemed nec-
essary by the Qualified Inspector.
3.6.4.3 Input
Detailed I&M actions out of the development phase of the I&M plan by skill and needed re-
sources.
Immediate actions e.g. extended measurements, tests, repairs, modifications and replace-
ments based on inspection findings and data under the responsibility of the Qualified Inspec-
tor.
a. Execute detailed I&M activities
b. Perform comparison of I&M results with Design Conditions
c. Make assessment of possible gaps.
d. Fix the obvious by immediate actions
e. Assure the compliance and sufficient Risk reduction is achieved. Review the
data and update the strategy on maintainable item level for future use.
f. Address the future actions and/or reviews for follow-up action where suffi-
cient Risk reduction is not immediately achievable.
3.6.4.5 Output
Documented inspection findings, measurements and data.
Depending on the situation:
a. Documented inspection measurements, findings, trends and results

b. Documented performance tests
c. Documented repair
d. Documented modification
e. Documented replacement
f. Updated Operation and Process plan

g. Updated I&M plan

h. Future actions needed for planned repairs, replacements
i. Reviews of data needed for update of (future) strategy with experts
j. Address lack of sufficient Risk reduction to organization for follow-up action
3.7 Evaluation of the process
3.7.1 Description
The purpose of the Evaluation of the risk-based decision-making process is to assess its ef-
fectiveness, its efficiency and its impact in the establishing of inspection and maintenance
programmes. This will allow the identification of areas where modifications and improve-
ments are needed. Specifically, Evaluation consists of the following tasks:
Task 1: Assessment of the effectiveness of the risk decision-making process at achieving
the intended goals (Assessment of Effectiveness)
Task 2: Updating the risk decision-making process by taking into account of possible
plant changes and available new knowledge (Reassessment of the Risk).
3.7.2 Requirements
The Evaluation process involves both internal and external assessment conducted by the
operating organisation and by independent external experts, respectively.
The internal evaluation by the plant organisation is an integral part of RBMI activity and
should be considered as a living process within the overall risk decision-making process. In-
ternal evaluation can take place in any moment of RBMI, especially when:
a. discrepancy from expectation is found (Task 1)

b. new knowledge is available or plant changes occur (Task 2)
In both cases, a detailed analysis of the importance of the involved item (discrepancy or new
knowledge/plant change) has to be conducted in order to assess whether it has a significant
impact on the RBMI process and some corrective actions should be undertaken. In these
cases a thorough analysis of the discrepancy causes or the new knowledge/plant changes
effects have to be performed.
External evaluation can be executed through independent reviews by external or regulatory

organisations (e.g., audits). Independent reviews provide an opportunity to complement the
internal evaluation with a different and neutral perspective. A point to note is that the value of
information provided by the independent review is directly proportional to the openness and
collaborative environment that external experts will find in the audited organisation. The inte-
gration of independent reviews with internal evaluation will allow the identification of neces-
sary actions for improvement.
3.7.3 Input
3.7.3.1 Assessment of effectiveness

a. Definition of risk decision-making process goals. (Risk may be expressed in
one or more of the following terms: safety, health, environment and busi-
ness impact)
b. Definition of Performance Indicators as a measure of the RBMI process
achievements against the above goals. (Note that in order to enable a
meaningful evaluation of the performance, consideration should be given to
the appropriate time frame applied for the various performance indicators.
Especially when a relation should be identified between the performance
and potential causes, it may be more meaningful when certain quantities are

assessed for a longer period of time. For example, the cost of inspection
and maintenance in year X has effect on the availability in a certain period
of time after year X.)
c. Reference to existing standards.
d. Benchmarking with similar operating organisations.
3.7.3.2 Reassessment of risk
Plant Information:
• Design changes
• Plant operating changes (mission, operational regime, production rate,
capacity, internal & external environment)
• Time dependent operating conditions (e.g., fatigue, cracks)
• Plant Management changes
• Level of personnel’s training change
• Industry wide operation experience feedback
• Inspection results (degradation rate of relevant degradation mecha-
nisms)
• Maintenance records
New Knowledge:
• Applicable research and development results
• Newly improved risk processes
• Advanced Inspection Methods
• Failure data
• Newly degradation mechanisms (absence / presence of unanticipated
degradation mechanisms)
• Newly data on inspection and testing effectiveness
3.7.4 Procedure/flowchart

This task can be fully exploited after defining the main goals of the risk-decision making
process and proper performance indicators to assess its effectiveness. The mentioned goals
and corresponding performance indicators are plant specific and depend upon the specific
risk based application considered. For instance, if risk assessment is focussed on econom-
ics, a possible performance indicator to assess the effectiveness of the risk decision-making
process is the effective cost reduction for the implementation of plant inspections and/or
maintenance, which is achieved by maintaining a similar level for safety.
This task corresponds to the feedback activity based upon the re-assessment of risk when
plant changes affecting failure probabilities or failure consequences occur. These changes
could be due to: design changes, plant operating changes, time dependent operating condi-
tions (e.g., fatigue), industry wide operation experience feedback, inspection results, etc.).
The affected portions of the risk based inspection and maintenance programmes shall be re-
evaluated as new knowledge affecting implementation of the programme becomes available.
For instance if a new degradation mechanism is discovered, the whole risk ranking must be
re-evaluated and the inspection and maintenance planning should vary accordingly. This dy-
namic or living process is one of the strengths of the risk based decision-making logic. It
leads to an enabling process that is both flexible and responsive to emerging problems.

Figure 3-10 Evaluation of the risk-based decision making process.
3.7.5 Output

• Periodical reports from internal reviews
• Reports from external audits
• List of discrepancies from expectations
• Methodical analysis of discrepancy causes, when applicable
• Proposal for improvement actions
• Periodical reports from internal reviews
• Reports from external audits
• Monitoring and feedback from operation
• Feedback from new knowledge
• Proposal for improvement actions
3.7.6 Warnings, applicability limits
Modifications in the process as well as modifications and/or repairs to the installation should
be designed and carried out in accordance with a written procedure reflecting appropriate
standards and agreed is advance. This procedure must include an evaluation of the possible
consequences of the change with respect to the integrity of the installation as well as the way
in which authorisation must take place. All information should be included in the plant data-
base and be available to the RBI-team for review.
4. Problem and hazard identification – damage mechanisms, plant hierarchy

This chapter considers the systematics, detection and analysis of damage in power plant
systems and components subject to RBI/RBLM analysis. It also presents the plant break
down or in other words, the component hierarchy that should be used in a power plant. Inno-

vative moment is shown at the end of this chapter (in Table 4-13) combining the damage
systematics with the plant hierarchy, actually giving possible scenarios.
The consideration of damage follows the flowchart shown in Figure 4-1.
Components
Considered
Operating loads
Damage appeared
(symptoms)
Decision which inspection

monitoring/inspections/analysis
methods according to
symptoms
for initial, pre-symptom
Determine measures in
appearance measures
Apply the inspection

methods and assess their
appropriateness/reliability
for the needs of
RBI/RBLM
Analyze damage and its

possible propagation
Figure 4-1 Damage considerations in this workbook
4.1 Damage Systematics

Note: Considering damage mechanisms (including systematics) is explained in detail in
PART III – APPENDIX A: Damage mechanisms
Based on the different damage mechanisms considered in the approaches of others (e.g.
VDI, API)2, a new approach is proposed here.
New damage systematics are shown in Table 4-1. These are later combined with the plant
hierarchy producing a Problems vs. Components matrix. Example of this matrix is given in
Table 4-13.
2
API 581, Risk Based Inspection Base Resource Document, First Edition, May 2000

Table 4-1 Types of in-service damage and their specifics: Classification

adopted in this work.
Id. Type of damage Damage specifics
MATERIAL DAMAGE RELATED PROBLEMS
I. Corrosion/erosion/environment related damage, equating or leading to:
I.A1 Volumetric loss of mate- General corrosion, oxidation, ero-
rial on surface (e.g. thin- sion, wear
I.A2 ning) Localized (pitting, crevice or gal-
vanic) corrosion
I.B1 Cracking (on surface, Stress corrosion (chloride, caustic,
mainly) etc.)
I.B2 Hydrogen induced damage (incl.
blistering and HT hydrogen attack)
I.B3 Corrosion fatigue
I.C1 Material weakening Thermal degradation (spheroidi-
and/or embrittlement zation, graphitization, etc. incl. in-
cipient melting)
I.C2 Carburization, decarburization, de-
alloying
I.C3 Embrittlement (incl. hardening,
strain aging, temper embrittlement,
liquid metal embrittlement, etc.)
II. Mechanical or thermomechanical loads related, leading to:
II.A Wear Sliding wear, cavitational wear
II.B Strain / dimensional Overloading, creep, handling dam-
changes age
II.C Microvoid formation Creep, creep-fatigue
II.D Microcracking, cracking Fatigue (HCF, LCF), thermal fa-
tigue, (corrosion fatigue), thermal
shock, creep, creep-fatigue
II.E Fracture Overloading, brittle fracture
III. Other structural damage
mechanisms
DISTURBANCES / DEVIATIONS / PROBLEMS (not related to structural materials)
IV. Fouling / deposits
V. Fluid flow disturbances High/Low fluid flow; no fluid flow;
other problems with fluid flow
VI. Vibration
VII. Improper dimensioning ,
improper clearances
VIII. Sabotage, terrorist at-
tack and man made dis-
turbances, fires, explo-
sions, and similar
IX. Disturbances and/or loss Break; leak including external leak-
of function age; improper start or stop; failed
while working; overheated; other

4.1.1 WHERE to look for (inspect / monitor) for which type of damage
Generally, types of damage defined in previous chapter (see 4.1) can be found on a very
large number of places in a plant depending on its construction, applied materials, operating
conditions, etc. For the purpose of a general overview, data on typical locations in different
types of plants are given in Table 4-2.

Table 4-2 Classification of type of damage vs. systems/components in different types of plants (FPP – fossil power plants,
NPP – nuclear power plants, PrP – process plants; weld critical in all components)
Type of damage Where to look for it
(typical sample components/materials)
Ide
n- Damage specifics, FPP - gas
Type of damage FPP - steam turbine NPP PrP
ti- damage mechanism turbine
fier
I.A1 General corrosion, oxida- boiler and super- blading, com- pump casings, Heat ex-
tion, erosion, wear heater tubing, LP pressor, LP turbine cas- changers,
solid particle erosion blading, and shaft combustor ings, condens- pipes, bends,
Volumetric loss of mate- pumps, valves ers, and shaft pumps, reactor
rial on surface (e.g. thin- vessels
I.A2 ning) Localized (pitting, crevice Boiler tubing, heat blading Heat ex- Heat ex-
or galvanic) corrosion exchangers, con- changers, changers, reac-
densers, LP-blades, steam generator vessels,
IP-/ LP-shaft tors pipes
I.B1 Stress corrosion (chlo- steam drums, LP tur- stainless pip- stainless pip-
ride, caustic, etc.) bines (disks, blade ing, LP turbines ing, reactor
attachments and (disks, blade vessels
blades), bolts attachments
and blades),
Cracking (on surface, bolts
I.B2 mainly) Hydrogen induced dam- waterwalls pressurizer crackers, col-
age (incl. blistering and umns, reform-
HT hydrogen attack) ers
I.B3 Corrosion fatigue waterwalls, drums, blading nozzles, safe- dissimilar welds
dissimilar welds, LP- end, sleeves,
blading LP-blading


Ide
fier
I.C1 Thermal degradation superheaters, hot combustors, heat ex-
(spheroidization, graph- headers, steam lines, hot blading, changers, re-
itization, etc. incl. incipi- casings, bolts transition formers, crack-
ent melting) ducts ers, pipes, re-
actor vessels
I.C2 Material weakening Carburization, decarburi- reformers,
and/or embrittlement zation, dealloying crackers
I.C3 Embrittlement (incl. forgings, bolts, shafts disks, clad- reactor pres- forgings, hot
hardening, strain aging, ding sure vessel vessels and
temper embrittlement, piping
liquid metal embrittle-
ment, etc.)
II.A Wear Sliding wear, cavitational pumps, valves, con- blade tips, pumps, valves, pumps, valves,
wear densers, sealing, seals, duct condensers, condensers
blading, bearings connections bearings
II.B Strain / dimensional Overloading, creep, han- hot steam lines, pi- blading fuel rod clad- hot piping, noz-
changes dling damage ping, T-Y pieces, ding zles, T-Y
bored rotors, casings pieces
(casing joint plane)
II.C Microvoid formation Creep, creep-fatigue hot steam lines (all, hot blading, hot piping, re-
incl. welding), head- combustors, former tubes,
ers, bored rotors, transition reactor vessels
ducts


Ide
fier
II.D Microcracking, cracking Fatigue (HCF, LCF), rotors, bolts, welds in disks, blad- thermal rotating ma-
thermal fatigue, (corro- heavy-section pipes, ing, com- sleeves, safe- chinery
sion fatigue), thermal valve internals, tur- bustors, end. valve in-
shock, creep, creep- bine shaft and blad- burner rings ternals, valves,
fatigue ing, casings turbine shafts
and casings
II.E Fracture Overloading, brittle frac- rotors, retaining rings, blading (for- rotors, disks vessel failures,
ture, foreign object dam- LP blading, super- eign-object pipe bursts,
age heater tubes, gears, damage), reformer tubes
disks gears

4.1.2 HOW to look for (inspect / monitor) for which type of damage
For the decision which method to apply and for inspection and what kind of result with witch
level of confidence can be expected, the preliminary data in Table 4-3 can be used.
For early discovery of damage, or decision making on where to look for possible damage
Table 4-4 can be used.

Table 4-3 Classification of type of damage vs. prioritized methods of inspection3

How to look for it 4 5 Measure of uncertainty/risk for selected/preferred
What type of damage
method6
selec- POD for defect size of or size FCP7;
Iden Damage specifics, damage most cost ted for com-
Type of damage best POD7
tifier mechanism effective meth 90% ments,
1 mm 3 mm
od POD examples
I.A1 Volumetric loss General corrosion, oxidation, DiM, VT, UT, (VT), 30÷70 50÷90
UT 2 mm
of material on erosion, wear ET, UT8 DiM % %
I.A2 surface (e.g. Localized (pitting, crevice or UT, DiM, 30÷70 40÷90
VT, UT UT 2 mm see 9
thinning) galvanic) corrosion ET % %
I.B1 Cracking (on Stress corrosion (chloride, MT, PT, MT, PT, 40÷90
ET 1÷85% 4±2 mm <5% 10
surface, mainly) caustic, etc.) ET ET %
I.B2 Hydrogen induced damage
UT, MT, MT, PT11,
(incl. blistering and HT hydro- UT na na na na
PT, ET MT12
gen attack)
3
Given measures of uncertainty/risk are given only where possible/appropriate and only as examples - in each particular case the user is advised to provide best possible data as function of mate-
rial, type of component, inspection conditions, inspector's qualification, etc.; the "selected method" is sometimes simply the one where sample data were available
4
proposed/ranked inspection methods
5
monitoring (on-line monitoring) not included – in some cases like in the cases of e.g. AE it can difficult to strictly distinguish between “inspection” and “monitoring”
6
if not mentioned otherwise all based on re-assessment of data of Rummel, Matzkanin, 1997
7
see acronyms in the main list of acronyms
8
AE - acoustic emission; PT - penetrant testing; DiM - dimensional measurements; XT - radiographic testing; VbM - vibration monitoring; DsM – on-line displacement monitoring; StM - on-line strain
monitoring; VT - visual inspection; ET – Eddy current testing; UT- ultrasonic testing; VTE - visual inspection by endoscope; MeT - metallography, including RpT (replica technique); MST - material
sample testing; na - not applicable
9
the estimate can be affected significantly by local effects (e. g. small-scale pits can remain completely undetected)
10
ET for non-ferromagnetic materials, sample results Rummel, Matzkanin 1997: ETAAA01-B
11
surface, also
12
subsurface


What type of damage
method6
1 mm 3 mm
od POD examples
13
I.B3 Corrosion fatigue 50÷99% 13,16
13 15 3±1 mm
MT, PT, MT, PT, 8÷96%
0.8±0.4
UT 14 ,1
ET, VT UT 86÷98% 95÷99% ,17
5 mm
I.C1 Thermal degradation (spher- (microscopy) ~100% POD for cracks > 1
oidization, graphitization, etc. MeT MeT MeT mm, 90% POD crack ca. 0.05 mm; main
incl. incipient melting) "reliability related problems" linked to
I.C2 Carburization, decarburization, wrong sampling, wrong preparation and
Material weak-
dealloying MeT MeT MeT wrong interpretation of replicas (all num-
ening and/or
bers are very rough “guesstimates”)
embrittlement
I.C3 Embrittlement (incl. hardening,
strain aging, temper embrittle-
MST MST MST na na na
ment, liquid metal embrittle-
ment, etc.)
II.A Wear Sliding wear, cavitational wear VT, DiM, VT, UT
ET
II.B Strain / dimen- Overloading, creep, handling required
sional changes damage resolution
DiM DiM DiM na na na
≤ 0.1 mm
or 0.5 %
13
crack length
14
crack depth
15
for welds as low as 20%
16
usually more than 5 mm for welds or steels
17
can be more than 5 mm for welds


What type of damage
method6
1 mm 3 mm
od POD examples
II.C Microvoid forma- Creep, creep-fatigue MeT (UT), MeT
tion
II.D Microcracking, Fatigue (HCF, LCF), thermal 20÷90 1.5÷6.5 mm
UT, PT 1÷90% 18
cracking fatigue, (corrosion fatigue), %
(MT/PT), MT/PT
thermal shock, creep, creep- 50÷90 2.5÷10 mm
ET, VT MT 5÷90% 19
fatigue %
II.E Fracture Overloading, brittle fracture VT, DiM VT VT na na na analysis
of causes
18
typical range; in extreme cases 0.5÷12 mm or more; more uncertainties for welds – but cracks transverse to welds detected easier than the longitudinal ones
19
typical range; in extreme cases 1÷18 mm or more; applicable for ferromagnetic materials (steels)

Table 4-4 Suggested measures for pre-symptom appearance measures leading to early discovery of damage in plants
Indicators coming from: Typical (specific) indica- Suggested approach to Suggested approach to Suggested approach to
tors: monitoring intermittent inspections engineering analysis
Manufacturing, assembly deviations from specifica- review of design and QC consider additional engi-
and quality control (e.g. tions regarding design / documents neering analysis
acceptance records) dimensions
deviations from specifica- review QC documents consider additional engi-
tions regarding integrity neering analysis
(e.g. broken parts), exces-
sive defects
deviations from specifica- review design and QC
tions regarding materials documents
(e.g. incorrect or defective chemical analysis
material)
other deviations from review design and QC
specifications regarding documents
Operation / condition temperature: too high / too consider additional moni- consider additional inspec- consider additional engi-
monitoring low, too high/low rate of toring measures tions neering analysis
increase/decrease
pressure/loading: too high, consider additional moni- consider additional inspec- consider additional engi-
too high/low rate of in- toring measures tions neering analysis
crease/decrease
vibrations: too high ampli- consider additional moni- consider additional engi-
tude, noise, other abnor- toring measures neering analysis
mal states
flow: leakage, blockage, consider additional moni- consider additional inspec-
slagging, etc. toring measures tions
other operational alarms consider additional moni- consider additional inspec- consider additional engi-
toring measures tions neering analysis

4.1.3 How to analyse and predict development of given types of damage

Once when a given type of damage has been detected and/or supposed, the analysis of the
damage consists of:
• Quantification
• Component life consumption (remaining and consumed life), and
• Damage propagation
For the purpose of RBI/RBLM it is desirable that this analysis is done in a probabilistic way.
The methods suggested for the damage types are given in Table 4-5.

Table 4-5 Suggested methods for the analysis depending on damage types
Iden- Type of dam- Damage specifics, damage mecha- Methods of Precision of life assessment/prediction, com-
tifier age nism analysis, predic- ments
tion
I.A1 Volumetric loss General corrosion, erosion, wear GB, CoB, CbC very low, guideline based solutions often very con-
I.A2 of material on Pitting GB, CbC servative, prediction considered very satisfactory
I.A3 surface (e.g. Localized (crevice, galvanic) CbC when in range minus 50%÷ plus 100%, often worse
thinning) results
I.B1 Cracking (on Stress corrosion DA, CbC
I.B2 surface, mainly) Hydrogen induced (incl. blistering) GB
I.B3 Corrosion fatigue DA, CbC
I.C1 Material weak- Thermal degradation (spheroidization, MetC, RP very low, guidelines and recommendations avail-
ening and/or graphitization, etc. incl. incipient melt- able only for testing and, partly, interpretation, pre-
embrittlement ing) dictions more qualitative than quantitative
I.C2 carburization, decarburization, dealloy- MetC
ing
I.C3 embrittlement (incl. hardening, strain DA, CbC
aging, temper embrittlement, etc.)
II.A Mechanical sliding wear, cavitational wear CbC as for I.C
wear
II.B Strain / dimen- overloading, creep St, CoB, CbC low, guideline/code based solutions often very con-
sional changes servative, prediction considered very satisfactory
when in range minus 15%÷ plus 30%, often worse
results, depending on e.g. temperature range and
material properties

Iden- Type of dam- Damage specifics, damage mecha- Methods of Precision of life assessment/prediction, com-
tifier age nism analysis, predic- ments
tion
II.C Microvoid for- creep, creep-fatigue RP, AP, CD, HD, low, guideline/code based solutions often very con-
mation CoB, MTh, XYZ, servative, prediction considered very satisfactory
MetC when in range minus 15%÷ plus 30%, often worse
results, depending on e.g. temperature range and
material properties
II.D Cracking fatigue (HCF, LCF), thermal fatigue, DA, CoB, CbC as for II.A, worse for complex loading mechanisms
(corrosion fatigue), thermal shock, and (often) poorly known material properties
creep
II.E Fracture Overloading, brittle fracture CoB, DA, CbC
AP – A-Parameter CD - Cavity-Density CoB - Code based (e.g. TRD) CbC - case-by-case

DA – Defect assessment HD - Hardness based MTh - Magnetite thickness MstC - based on metallographic classifica-
tion/characterization
RP - Replica class based St - Strain-based analysis XYZ - other GB – guideline-based (e.g. EPRI, VGB, Nordtest)

4.2 Plant Breakdown - Standard Power Plant Hierarchy for RBI / RBLM: What
kind of problems are most likely to appear and where
4.2.1 RIMAP Power Plant Standard Hierarchy

RIMAP Power Plant Standard Hierarchy (see Table 4-6) gives examples of hierarchies used
for systems and components in a power plant, e.g. the KKS20 one, those used in the other
projects/reports and similar. In addition there are many similar hierarchies available at single
plant/utility levels.
Virtually, everybody dealing with power plants has it because the hierarchy is needed for la-
belling, organization, database purposes, purchasing, maintenance – just for about any activ-
ity in a plant.
When defining the “RIMAP Power Plant Standard Hierarchy”, the standard (e.g. KKS) solu-
tions have been examined first, but they, as well as the solutions from other projects could
not be used directly. The KKS one, for instance, was “process oriented” and those from other
projects are not covering the full range of components for RBI/RBLM needs of RIMAP.
Hence, a specific RIMAP hierarchy, for power plants, was defined (Table 4-6). It covers vir-
tually all of the KKS major systems except:
• “Nuclear” chapters (F, J, K)

• District heating chapters (P)
• Auxiliary plant chapter (Q)
• Gas plant chapters (R)
• Infrastructure chapters (S, U), and
• Special chapters (W, X, Z)
All other chapters are covered, of course with emphasis on the components relevant for
RBI/RBLM.
The hierarchy (breakdown) follows the logic shown in Figure 4-2.
20
KKS – Kraftwerk-Kennzeichensystem, VBG-KRAFTWERKSTECHNIK GmbH, December 1988

USUAL OBJECT HIERARCHY

(Country)
(Company)
Site
Plant
Unit
System (function)
Subsystem
Component
Part
Location
SUBHIERARCHY
Problem / Issue
Failure mode
Failure mechanism / cause
Observation / analysis
Figure 4-2 Example of typical hierarchy (breakdown) structure; usually the lev-
els are optional and the problem/issue sub hierarchy can be attached at virtu-
ally any level
The Table 4-6 shows the typical power plant breakdown according to KKS with some modifi-
cations (KKS – Kraftwerk-Kennzeichensystem, VBG-KRAFTWERKSTECHNIK GmbH, De-
cember 1988):
Table 4-6 RIMAP Power Plant hierarchy

Conventional fuel supply and waste disposal (E)
Solid fuel systems
Distribution and storage (EA, EC)
Loading/unloading equipment (EAA, EAB)
Transport belts, pipes (EAC, EBA, HFB, HHE)
Bunkers, heaps (EAE)
Processing (EB, HF)
Crushers, mills (EBC, EBD, HFC)
Liquid fuel systems (EG)
Transport, storage
Pumps (EGC), pipes (EGA, EGD), tanks (EGB)
Gaseous fuel systems (EK)
Transport, storage
Compressors (EKH), pipes (EKA, EKG), tanks (EKF)
Water systems (G, L)

Feedwater/boiler water systems (G, L)

Feedwater treatment
Feedwater treatment (GA, GB, GC)
Condensate treatment
Condensate polishing (LD)
Boiler water transport
Feedwater pumps (LAC)
Condensate pumps (LCB)
Feedwater piping (LAB)
Feedwater tank, deaerator (LAA)
Feedwater heaters (LAD)
HP feedwater heaters
LP feedwater heaters
Conventional power production (H)
Boilers (HA)
Boiler tubes
Economeiser tubing (HAC)
Risers/downcomers (HAG)
Waterwall tubing (HAD)
Superheater (HAH)/ reheater tubing (HAJ)
Boiler tube attachments
Headers and drums
Steam drums (LBJ)
Economiser headers (HAC)
Waterwall headers (HAD)
Superheater (HAH)/ reheater (HAJ) headers
Drainage / deaerating fittings (HAN)
Combustion
Burners (HHA, HJA)
Fireside cleaning, sootblowers (HC)
Ash / slag removal (HD)
Air / flue gas system
Air preheaters (HLD)
Major fans (HLB)
Boiler structures
Boiler casing/flue gas channel (HBA)
Cladding/insulation (HBC)
Steam system (L)
Steam piping (LB)
Steam piping
Interconnection piping (LBA)
Main steam piping (LBA)
Hot reheat steam piping (LBB)
Main stop valves
Safety valves
Attemperators
Attemperator piping
Cold reheat piping (LBC)
Main rotating machinery (M)
Steam turbines (MA)

HP/IP turbine
Casings (MAA/MAB)
Steam chest with valves (MAA/MAB)
Rotors (MAA/MAB)
Bearings (MAD)
Blades (buckets) (MAA/MAB)
Vanes (nozzles, diaphragms) (MAA/ MAB)
Gland seals (MAA/MAB)
Bolting (MAA/MAB)
LP turbine
Casings (MAC)
Steam chest with valves (MAC)
Rotor (MAC)
Bearings (MAD)
Blades (buckets) (MAC)
Vanes (nozzles, diaphragms) (MAC)
Gland seals (MAC)
Bolting (MAC)
Condenser (MAG)
Condenser tubing and water boxes
Auxiliary equipment
Couplings, gears (MAK)
Lube oil system (MAV)
Gas turbines (MB)
Rotor & casing
Rotor bolts (MBA)
Turbine disks (MBA)
Shrouds & seals (MBA)
Turbine blades (buckets) (MBA)
Turbine vanes (nozzles) (MBA)
Compressor blades and vanes (MBA)
Combustion / hot path
Combustor cans, liners, burners (MBM, MBT)
Transition pieces (MBT)
Thermal shields (MBT)
Auxiliary systems
Gearbox, couplings (MBK)
Bearings (MBD)
Lube oil system (MBV)
Generators (MK)
Rotor, stator & casing
Rotor (MKA)
End caps (retaining rings) (MKA)
Stator windings, bushings and terminals (MKA)
Auxiliary systems
Cooling equipment (water/air, H2/N2) (MKF/MKG/MKH)
Bearings (MKD)
Lube oil system (MKV)
Control systems
Controls & protection

Electronics, relays, insulators

Electric distribution (A,B)
Electric distri-bution
Switchgear & transformers
Switchgear (AB - AN)
Cables, leads (BA, BB-BN)
Transformers (BB - BN)
Electric equipment
Motors
Rotors
Bearings
Windings
4.2.2 Example of plant hierarchy from process industry

RIMAP Process Plant Standard Hierarchy (see Table 4-7) gives examples of hierarchies
used for systems and components in a process plant, e.g. the KKS one, those used in the
other projects/reports and similar. In addition there are many similar hierarchies available at
single plant/utility levels.
Table 4-7 Example of typical process plant breakdown (Plant / Unit / Sub-unit)
Typical Process plant breakdown
Refining
Alkylation
Catalytic Cracking
Section 1
Section n
Catalytic Reforming
Section 1
Section n
Crude Distillation Unit (CDU)
Section 1
Section n
Vacuum Distillation unit (VDU)
Section 1
Section n
Gas treating – H2S removal (Amine washing…)
Section 1
Section n
Hydrocracking
Section 1
Section n
Hydrodesulfurization
Section 1
Section n
Hydrotreating
Section 1
Section n

Typical Process plant breakdown

Isomerization
Section 1
Section n
MTBE / ETBE
Section 1
Section n
Sulfur Unit
Section 1
Section n
Visbreaking
Section 1
Section n
Storage
Section 1
Section n
Petrochemistry
Steam Cracking
Section 1
Section n
The corresponding hierarchy for the equipment is presented in the table bellow (see Table
4-8)
Table 4-8 Example of list of Process equipment with main technologies

Process Equipment
Reactor Single Bed
Double bed
Simple integrity
Double integrity
Heat Exchanger Tubes

Plate HE
Column Trays
Furnace
Air-coolers
Drums / Pressure vessel
Filter
Storage tanks Floating roof
Fixed roof
Utility Boiler
Sphere
Pipings
Compressor
Pump
Valve

Example of the hierarchy for the sub-equipment in a process plant is presented in the Table
4-9
Table 4-9 List of process sub equipment - example

Process Equipment
Reactor Head
Bottom
Shell
Nozzle
Heat Exchanger Tubes
Box
Shell
Column Top
Bottom
Shell
Nozzle
Furnace Radiation
Convection
Pre-heater
Air-coolers Box
Tubes
Drums / Pressure vessel Head
Bottom
Shell
Nozzle
Boot
Filter n/a
Storage tanks Roof
Shell
Bottom
Utility Boiler21 Super-heater
Economizer
Pressure vessel
Combustion chamber
Sphere n/a
Piping n/a
Compressor22 n/a
Pump n/a
Valve n/a
4.2.3 Hierarchy vs. Problems covered by the RIMAP Power Workbook

Linking component types and likely damage mechanisms with the RBI/RBLM consideration
is a real “table of contents” of this workbook. The idea is not new, e.g. in the works of EPRI
and INNOGY (Table 4-10and Table 4-11) for boiler components and inspections, as well as
in some other works (see Table 4-12 showing Heat Recovery Steam Generation – HRSG
21
Specific issues related to boilers used in Process plants are not considered separately in this version of the document. For the
generic information related to this type of equipment, see the RIMAP Application Workbook “Power”.
22
The dynamic equipment are not detailed in this version of the document. . For the generic information related to this type of
equipment, see the RIMAP Application Workbook “Power”.

components and their vulnerabilities to certain damage mechanisms), such approach has
been also applied here.
Table 4-10 An example of linking components, damage mechanisms and in-

spections techniques (EPRI23)
Boiler Area Tube sam- Boat sam- Replicas Inspection Primary failure
ples required ples for Methods (a) mechanis (b)
testing
Secondary
superheater
Outlet X X ABCHEFK 123
header
Tube X G 1237
bank(s)
Inlet header X EHK 123
Attempera- CF 125
tor
Connection X X GM 123
Piping
Reheater /
Superheater
Outlet X X ABCEHFK 123
header(s)
Tube X G 12347
banks(s)
Inlet header X EHK 123
Attempera- CF 125
tor
Connection X X GM 123
Piping
Primary
Superheater
Outlet X ABCEFHK 123
header(s)
Tube X G 1234
bank(s)
Inlet X EHK 235
header(s)
Connection X GM 235
Piping
Economizer
Inlet AFK 2356
header(s)
Tube X GL 2346
banks(s)
Outlet AFK 2346
header(s)
Furnace X DGL 2345
enclosure
tubes
Convection DGL 234
pass enclo-
sure
Drum EHJ 2356
23
Condition Assessment Guidelines for Fossil Fuel Power Plant Components, EPRI GS-6724, March 1990

Boiler Area Tube sam- Boat sam- Replicas Inspection Primary failure
ples required ples for Methods (a) mechanis (b)
testing
Waterwall AC 23
headers or
collection
headers
Waterwall X DL 23
tubes at
attachments
a. A – Header stub and hard hole cap removal and internal inspection. B –
Header dimensional measurements. C – Ultrasonic flaw detection (an-
gle/beam). D – Radiography. E – Dye penetrant. F – Fiber optic probe. G –
Ultrasonic thickness testing (scope type). H – Magnetic particle. I – Field al-
loy detector. J – Wet fluorescent magnetic particle. K – Stub tune magnetic
particle. L – Tube removal attachments. M – Strain monitoring (dimen-
sional).
b. 1 – Creep. 2 – Fatigue. 3 – Corrosion. 4 – Erosion. 5 – Thermal shock. 6 –
Deposition.
Table 4-11 An example of linking components, damage mechanisms and in-

spections techniques (INNOGY)
Component Over- Differential Thermal Corrosion Electrical
heating Expansion Fatigue /EA Insulation
Failure
HP Feedheaters
Economizer Inlet Header
Waterwall Tubing
Radiant Superheater Tubing
Pendant Superheater Outlet Header
Final Superheater Outlet Header
Other Headers
Pipework
HP Steam Chests
HP Turbine
Reheater Tubing
IP Steam Chests
IP Turbine
LP Turbine
Boiler Casing
Generator rotor
Switchgear
Small auxiliaries

Table 4-12 HRSG components and their vulnerability to damaging mechanisms

(Pasha, Allen, 2003)
Corr. Product Migration

Differential Expansion
Oxidation/Exfoliation
Flow Acc. Corrosion

Damage Mechanism
Chemical Corrosion
Low Cycle Fatigue
Corrosion Fatigue
Thermal Shock
Creep
HRSG Component 1 2 3 4 5 6 7 8 9
Superheaters √ √ √ √ √ √
Attemperators √ √ √ √ √ √ √
Reheaters √ √ √ √ √ √ √
Evaporators √ √ √ √ √ √
Economizers √ √ √ √ √ √
Drums √ √ √ √ √
Piping √ √ √ √ √ √ √
Valves √ √ √ √ √
Fins & Tubes √ √ √ √ √ √ √
Liners, Casing etc √ √ √ √ √
Ducts √ √ √ √
Dampers √ √ √ √
Structurals √
Stacks √ √
Innovative moment is however that in this workbook it has been done in a very detailed,
down-to-the-component-level way and for the purpose of RBI/RBLM. The result is the new
matrix, excerpt is given in Table 4-13, showing:
• which problems
• with witch priorities
might be considered as likely to happen for different components. These are indicated by
one, two or three stars ( or ) in the table, where number of stars indicates importance
and likelihood (three stars – most important, likely) and the color of the star shows the state
of work in this issue of the workbook: black stars () indicate existence of the correspond-
ing subchapter and the white ones () the intention to provide the corresponding subchapter
for this problem. The gray ones () indicate that the provided information is not complete.
Beside marking which damage mechanisms are likely to be found on certain components,
Table 4-13 goes one step further and gives three, most-likely-to-happen, scenarios for each
component, combining the failure causes and giving a failure mode/appearance. These are
marked with the symbol (9).
One more innovative thing in Table 4-13 is the last column designated as a “flag” column. It
is foreseen that in this column a “flag” (a character that indicates certain state) gives addi-
tional information about the component (e.g. related to safety) and/or suggested level of
analysis (e.g. detailed analysis). Types of flags are:

• A – related to active components

• S – related to safety
• E – related to environmental issues
• D – detailed analysis recommended (only)
• I – intermediate analysis recommended
• Scr – only screening is sufficient
The scope of the Table 4-13 (and the workbook itself) is like already discussed and shown in
Table 2-1. The table with hierarchy vs. problems matrix (Table 4-13), contains also equip-
ment from process industry, covering selected systems/components (like shown in Table 2-1
and discussed in previous chapter, see Chapter 4.2.2)

∗
Boilers
st
rd
nd
Boiler tubes
EVENT, PROBLEM, ISSUE…
Document title:
1 Scenario
3 Scenario
2 Scenario
Document number:
Revision number: 0
Economiser tubing
I.A1 General I.A. Volumet-
9
9
9
corrosion ric loss of ma-
I.A2 localized terial on sur-

corrosion face
I.B1 stress I.B. Cracking
corrosion (on surface,
I.B2 hydrogen mainly)
damage
I.B3 Corrosion
fatigue

I.C1 thermal I.C. Material

degradation weakening
I.C2 carburiza- and / or em-
age, equating or leading to:
tion brittlement
I.C3 embrittle-
4-41-W-2002-01-0
ment (strain)
Page 78 of 135
II.A1 sliding II.A. Wear

wear
RIMAP Application Workbook for Power Industry
II.A2 cavit. wear
9 9
9 9
9 9
II.B1over- II.B. Strain di-
loading, creep mensional
II.B2 Handling changes
damage
II.C1 creep, II.C. Micro
void forma-
II.C2 creep- tion
to:
fatigue
II.D1 fatigue II.D. Micro

(HCH, LCF), th. cracking,
9
9

Fatigue… cracking
MATERIAL DAMAGE RELATED PROBLEMS (Failure causes)
II.D2 Thermal
schock, creep…
II.E1 overload- II.E. Fracture

ing
II.E2 brittle
Restricted
fracture
I. Corrosion/erosion/environment related dam- II. Mechanical or thermo-mechanical loads related, leading
III. Other structural damage mecha-

nisms

IV. Fouling / deposits

V.A HFF/LFF
Flag indicating the component relation (e.g. A – active components) and/or recommended level of analysis (e.g. D – detailed analysis needed)
– High/Low
Table 4-13 Component hierarchy vs. problems
Fluid Flow
V.B NFF – No
fluid flow
V.C OFFP –
disturbances
Other fluid
V. Fluid flow
flow problems
VI. Vibration
VII. Improper dimensioning,
improper clearances
VIII. Sabotage , terrorist attacks and
man made disturbance, Fires, ex-
plosions and similar
IX.A Break
9
IX.B Leak incl.

9
9
external leak-
age (EXL)
IX.C Improper
start or stop
modes, failure appearances)
(FTS)
loss of function
IX.D Fail while

working (FWR)
IX. Disturbances
IX.E Over-
heated (OHE)
IX.F Other/
(OTH)
and/or
∗
Flag : Related to: active compo-
nents (A), safety (S), environment
DISTURBANCES / DEVIATIONS / FUNCTION RELATED PROBLEMS (Failure
(E) detailed analysis needed (D)

5. Multilevel RISK Analysis

Since assessing the risk is one of the most important parts of the whole risk analysis, this
chapter provides more detail on the subject, and gives references to additional information
which is provided in appendices.
5.1 Introduction
Risk of an unwanted event being defined as a product of probability and consequences of
that event is in RIMAP determined according to the “Bow Tie” model (see Figure 5-1).
“Bow Tie” is nothing else but simply a scenario for an unwanted event. In order to build sce-
narios for each analyzed item, probability and consequences for that event have to be de-
termined first, and then combined.
Failure or main event (e.g. – “adverse event”,

problem, issue, functional problem, operational
disturbance or similar) the probability and
consequences of which are analyzed in order to
define risk related to it.
Consequence tree
CoF analysis e.g. by
CoF means of an event tree
Cause tree:
Event
PoF analysis PoF
covering e.g.
failure modes,
causes etc.
Figure 5-1 Simplified Bow Tie model with PoF on one side and CoF on the other
5.2 Probability of Failure determination

General model for PoF determination has already been shown in Figure 3-8and a more de-
tailed one is presented in Figure 5-2. The basic idea is combining different element’s to get
the basic PoF estimate which can be then corrected by expert’s opinion. Expert’s can be
used as a correction on all levels as well as a starting point of the analysis.

E/J
PoF value based PoF’ Basic Expert’s correction PoF/LoF value
on Expert for risk analysis
PoF/LoF estimate of basic PoF value
Judgment
AND/OR
H/S F/M
Expert’s correction of PoF value from PoF value from Expert’s correction of
PoF value (e.g. History and Forecast and PoF value (e.g.
human expertise) Statistics Models human expertise)
Historical data Future or Forecast

(e.g. previous (e.g. component
failures, maint.) behavior
Statistical analysis Statistical analysis
Figure 5-2 Elements of PoF determination in RIMAP
The model presented above is modular, meaning that not all elements must be used (this is
usually the case in practice, since not all that is always available).
Detailed representation of a multilevel PoF analysis can be seen in Figure 5-3.
Note: All details on PoF determination including statistical analysis, PoF combining logic, ex-
amples etc. are given in PART III – APPENDIX B

1. INITIAL INPUT 2. INITIAL PoF=PoF’ 3. CORRECTION / 4. PoF

UPDATING
Inspection / CoF Other

Monitoring additional info
SYSTEM / COMPONENTS
SCREENING
GENERIC / DEFAULT
REASONING FOR
DATA PoF’ generic PoF generic
CORRECTION
UPDATING /
MODELS
User’s
ENEGINEERING correction /
(PHYSICAL) MODELA PoF’ prescreening updating PoF prescreening
BASED ANALYSIS
EXPERT’S OPINION PoF’ screening PoF screening
PoF
List / Ranking /
Evolution
INTERMEDIATE TO DETAILED
REASONING FOR
ENEGINEERING
PROBLEMS / ISSUES
CORRECTION
(PHYSICAL) MODELA
UPDATING /
PoF’ issue n
MODELS
BASED ANALYSIS User’s

correction / PoF
updating
EXPERT’S OPINION PoF’ issue m
Inspection / CoF Other

Monitoring additional info
Figure 5-3 Multilevel PoF analysis

5.3 Consequence of Failure Determination

Since the consequence of failure analysis in the power plants is mainly based on the analysis
on economic consequences, other types of consequences are not discussed here. For more
details on RIMAP Consequence Analysis please refer to RIMAP documentation, mainly to
D3.1 and its’ appendices (RIMAP D3.1 2004).
Economic consequences, typical for the power plants, are shown in detail on worked exam-
ples presented later in this document (see Chapter XXX)
5.4 Risk – Getting a “Bow Tie”

Linking PoF (Probability of Failure) and CoF (Consequence of Failure) into a “bow-tie” in or-
der to get risk has generally been explained and shown in previous chapters. This is de-
scribed in more detail in RIMAP D3.1 document (see [RIMAP] 2004 D3.1). For practical im-
plementation please refer to RIMAP worked examples given further in this document.
6. Standard Data Format for the RBI/RBLM in RIMAP Workbook for Power
Plants
6.1 Format for System / Component records

The format has the following structure:
Component specific data or upper (lowest) level data
a. General Description of the component, typical data, description of

generally known problems and/or failures, and/or exam-
ples of problems, similar issues of generic relevance
b. Basic PoF’ data Essentially a table including:

Source of data
PoF’ values – (min)∗, mean, max
Units (e.g. number of failures per unit – year)
Reference
Comments / notes
One of the PoF’ values is to be marked “default”, i.e. it is
used when other info about the component is not given /
known. PoF’ values from more/several sources
can/should be provided (e.g. for different types/sizes of
the component). Furthermore, textual and other informa-
tion regarding e.g. realiability/availability of component is
occasionally added.
∗
normally not given

c. Component PoF’ related These questions essentially lead to the conclusion if and
questions how the initial PoF’ values should/could be changed
(e.g. increased). For each set of questions two values
are established:
Max. decrease of PoF’ value (the QCFmin factor),
and
Max. increase of PoF’ value (the QCFmax factor)
Single questions are formatted in such a way that:
They can be answered by YES/NO only, and
The respective contribution of the answer
(YES/NO) to decrease/increase PoF’ value is
given.
The measure of contribution to the increment/decrement
is given by either:
Crisp number, or
Linguistic term (fuzzy, e.g. “decreases very
much” and similar)
Additional information…
d. Basic CoF’ data As for PoF’ the following data is provided for CoF’:
Source
CoF’ values (min∗), mean, max
Units (e.g. $ or €)
References
Comments/notes
One of the values is to be marked as “default”, i.e. it is
used when other information on component is not
given/known.
Values from more/several sources can/should be pro-
vided. Furthermore, additional textual and other informa-
tion can be provided too (e.g. examples or statistics of
typical consequences, like cost)
e. Preventive and corrective Here, the measures leading to prevention of outages on

actions organisational and engineering level are
listed/described. These measures should e.g. lead to
reduction of outages, improvement of productivity and
similar.
f. List of problems for which Apart from the very list, a flow chart showing how de-
further details are cov- pendant the problems are, should be provided.
ered by the workbook
Note: Each entry listed above can have subentries (e.g. a.1)
∗
normally not provided

6.2 Format for Problem related records

The format for describing each significant component problem has the following format:
a. Priority of the problem
shows the priority of the problem using sign system like in the Table 4-13
b. Description
provides short description of the problem giving most important and relevant
information
c. Damage, cause of the problem

short description of possible causes of the problem (from most to less signifi-
cant)
d. Methods to find and quantify the symptoms of the problem

description of suggested techniques for finding the symptoms of the problem
e. Scale for measuring extent of the problem

provides a scale (usually in a form of a table) and a short description for ex-
tension of the problem
f. Scale for measuring severity of the problem

provides a scale (usually in a form of a table) and a short description for se-
verity of the problem
g. Suggested scale for failure frequencies

provides a scale (usually in a form of a table) for both qualitative and quanti-
tative frequency of the problem, together with short description if needed
h. Methods and tools to calculate PoF

names and briefly describes approaches (methods) how to calculate PoF’
and suggests tools (software) for that use
i. Controllability / Predictability of the problem

gives a scale (usually in a form of a table) with short description how to con-
trol / predict the problem
j. Resources, constraints
gives a description (and a table) about resources and constraints of the prob-
lem and how they affect PoF’
k. Economic consequences
description and a table for determining economic consequences that the
problem can cause.
l. Environmental consequences
description and a table for determining environmental consequences that the
problem can cause.
m. Health and Safety consequences

description and a table for determining health and safety consequences that
the problem can cause.

6.3 Example “formatting” of information for the purpose of RBLM analysis:

ECONOMIZER (HAC)
The selected example will assume that a single system/component has to be analyzed as a
single item for the purpose of the RBLM and/or RBI/RBMI. The selected component for the
example is:
ECONOMIZER (KKS∗ code - HAC)
The system/component analysis is based on the following two main assumptions:
a) Some information from the upper hierarchical levels (e.g. “boiler” and “boiler
tubes” levels, respectively) is important for the analysis – i.e. some relevant in-
formation is “inherited” from the upper levels. These upper levels can be ex-
tracted from the hierarchy (“plant breakdown”) presented in Chapter 4.2 (see, e.g.
Figure 4-2, and Table 4-13)
b) Furthermore, for the detailed analysis single problems relevant for the component
should be tackled, primarily those listed in Table 4-13.
The application of the above made assumptions is shown in Figure 6-1, for the most general
case and in Figure 6-2, for the particular example.
The selected information, otherwise given in detail in PART II for the whole “Plant Break-
down”, is given here in Chapters 6.4 to 7.
Boilers “Inherited”
information /
Boiler Tubes (HA) knowledge
Economizer Tubing
Problem #1: General Corrosion

Problem #2: Localized Corrosion Information
Problem #3: Fatigue cracking / knowledge
needed for
Problem #4: Wear detailed
analysis
Problem #5: Fatigue
Problem #6: Fouling
“Inherited”
Header and Drums information /
knowledge
Economizer Headers
Problem #1: General Corrosion Information

Problem #2: Localized Corrosion / knowledge
needed for
Problem #1: Corrosion Fatigue Cracking detailed
analysis
Problem #2: Fatigue
Figure 6-1 Full set of elements for the RBLM analysis of the economizer
∗
KKS – Kraftwerk-Kennzeichensystem, VBG-KRAFTWERKSTECHNIK GmbH, December 1988

Boilers “Inherited”
information /
Boiler Tubes (HA) knowledge
Economizer Tubing
Information
Problem #1: General Corrosion / knowledge
needed for
Problem #2: Fatigue cracking detailed
analysis
Figure 6-2 The subset of elements chosen for the RBLM analysis taken for this
example
6.4 Boiler General

Boiler General
(a) General (a.1) General description
Boilers, by means of controlled combustion of fuel in air, efficiently con-
vert the chemical energy contained in fuel to heat energy which is used to
generate high pressure, high temperature steam. The heat is absorbed
through the surfaces of a series of tubes. In the waterwall tubes water is
vaporized into steam, and that steam is superheated in the superheater
tubes. Expended high-pressure steam from the steam turbine is reheated
in the reheater tubes before it is re-injected into lower pressure sections
of the turbine. Incoming water is preheated in an economizer by extract-
ing waste heat from flue gas before it exits the boiler system (Figure 6-3).
The objective of this extensive heat exchange process is to improve
overall cycle efficiency.

Boiler General
Figure 6-3 Boiler Heat flows (EPRI).

The overall efficiency of the boiler, typically around 90% benefits from
heat recovery downstream of the superheater. Thus the economizer re-
covers energy from boiler flue gas to heat the boiler feedwater, and the
air heater also recovers energy from flue 2as to heat combustion air.
Since the boiler is at the "high exergy" end of the power plant cycle, it
pays to give attention to careful minimization of any wasted boiler energy
going up the stack.
(a.2) Boiler design process

The design of a boiler is an complex process involving economic trade-
offs among the competing parameters of fuel characteristics and cost,
initial capital investment, performance, maintenance schedules and com-
ponent life. Boilers designed in the 1940's, and early 1950's, had capaci-
ties which were generally less than 300 MW. These were designed with
large fireboxes, so that relatively low neat-release rates could be utilized
to prevent overheating of the boiler tubes. In the late 1950s to mid 1960s,
competitive pressures forced design approaches that resulted in rapid
increases in boiler capacities. These designs utilized higher heat release
rates resulting in output capacities in excess of 600 MW. The designs for
the period that followed often had to accommodate the use of western
sub bituminous coals. These coals have low ash fusion temperatures and
contain alkali compounds that can cause plugging in the back end of the
boiler due to condensation. As a result, larger furnace volumes were
necessary and heat release rates decreased. Design details of typical
400 MW pulverized coal boilers that are being designed today are shown
in the following table.
Table 6-1 Typical design conditions for 400MW pulverized coal
fired boilers.
Characteristics Subcrltlcal Supercrlticsl
Main steam temperature, of ( °C) 1,050 (566) 1,050 (566)
Main steam pressure, psia (bar) 2,400 (168) 3,500 (245)
Main steam flow, Ibs/hour (kg/hr) 2,610,000 2,700,000 (1,224,000)

Boiler General
(1,184,000)
Reheat steam temperature, °F( °C) 1,050 (566) 1,050 (566)
Hot Reheat steam pressure, psia 590 (41.4) 630 (44.2)
(bar)
Reheat steam flow,lbs/hour (kg/hr) 2,320,000 2,240,000 (1,016,000)
(1,052,000)
Coal Flow,lbs/hour (kg/hr) 315,000 308,000 (140,000)
(143,000)
Air Flow, Ibs/hour (kg/hr) 3,211,000 3,146,000 (1,427,000)
(1,456,000)
The following sketch (Figure 6-4) of a modem fossil steam boiler posi-
tions the various heat exchanging elements. In the boiler design process,
heat release to all these heat exchangers depends on fuel heat release
rates and burner locations, so any change to the fuel mix will affect the
proportion of heat absorbed in the various tube banks. Coal boilers can
be quite flexible in handling different mixes, but on occasion heat ex-
change tubing might need to be added or subtracted.
Figure 6-4 Typical boiler layout.

Boiler General
(b) Basic PoF’ Fossil boilers in North America currently have an average availability of
data about 90 %. As shown in Table 6-2, about half the availability loss is re-
lated to planned inspections and major overhauls, which occur infre-
quently, typically every two to three years, but require a lengthy outage.
The other half of the loss is associated with unexpected operating issues,
notably tube leaks.
Table 6-2 Forced and scheduled outages and deratings of boil-

ers (NERC GADS Data 1992-1996).
Component Average Equivalent Average Number of
Unavailable Hours Outages per Unit Year
per Unit
Year
Boiler- Total 648.42 11.76
Overhaul and Inspec- 333.32 0.65

tion
I Tube Leaks 159.54 2.97
i Air and Gas Supply 57.83 2.68
; Miscellaneous 33.95 0.69
Control Systems 20.45 1.34
Miscellaneous Tube 20.03 0.17
Problems
Slagging and Fouling 15.19 1.40
Water Conditions 7.05 1.83
Design Umitations 1.07 0.02
Figure 6-5 Major problems in Cycling Fossil boilers (A.F. Ar-

mor, R.H.Wolk, Productivity Improvement Handbook for Fossil
Steam Power Plants, EPRI, September,1998.)

Boiler General
(c) Compo- No data / information provided
nent PoF’
related
questions
(d) Basic CoF The following table gives a rough assumption about a replacement cost
data for the whole system (Otakar Jonas, P.E., Ph.D., Corrosion and water
shemistry problems in steam systems – root causes and solutions,
http://www.mindspring.com/~jonasinc/root_causes.htm)
System Cost of re- Length of Out-

placement age (weeks)
(M€)
PWR Steam Generators 150 - 200 26 - 52
BWR Piping 70 52
Fossil Boiler Water Walls 5 - 12 20 - 32
Fixing Boiler Tube Leak 0.1 - 0.5 2 days
Secondary Superheater & Rehea- 5-8 12 - 26
ter (high temp. part)
(e) Preventive The major issue that must be dealt with is the additional stress on com-
and cor- ponents that results from cycling conditions. Temperatures and environ-
rective ac- ment emissions change frequently. Instrumentation must be installed to
tions provide information to the operators so that the system can be optimized.
Procedures have to be changed to ensure that allowable conditions are
not exceeded and remaining life consumption is economically justified. It
is obvious from the following enumeration that there are many concerns
that must be dealt with promptly to allow the boiler to provide power re-
liably and economically.
Main activities to minimize thermal stresses:

• Modify start-up/shutdown procedures
• Add/upgrade temp. instrumentation
• Upgrade boiler controls
• Add thermocouples
• Increase inspection frequency
• Add system for heating components when off-line
• Add boiler stress monitor
• Upgrade flexibility of superheat, reheat
• Add drainage superheater, reheater
• Modify waterwall tieback
• Add boiler bypass around superheater, reheater
• Add boiler – furnace movement monitor
Main actions to reduce corrosion:
• Add auxiliary steam supply for turbine seals and
condenser steam ejectors, deaerator
• Add deaerating system (FW heat/condenser)
• Add steam purity monitor

Boiler General
• Add full – flow polisher
• Add bypass system for condensate polishing
• Increase blow down capability
Main actions to avoid overheating (superheater, reheater, waterwalls):

• Heat trace value body
• Change circuitry (once – trough)
• Upgrade start-up valves
• dd integral separator (once – trough)
• Increase quick drain capability
(f) List of No data / information available

problems
for which
further de-
tails are
covered
by the
book
6.5 Boiler Tubes

Boiler Tubes
(g) General Boiler tube failures are currently responsible for about a 3 % loss of
availability in US coal-fired plants with capacities above 200 MW. As indi-
cated in Figure 3-4, this figure reached a minimum of about 2.6 % in the
early 1990's but has trended upward toward previous levels since then.
Figure 6-6 Equivalent Unavailability Factor (EUF) Due to Boiler

Tube Failures in Coal Plants Larger than 200 MW (A.F. Armor,
R.H.Wolk, Productivity Improvement Handbook for Fossil
Steam Power Plants, EPRI, September,1998.)
In the 1980's and early 1990's boiler tube failures decreased as greater
knowledge was gained on failure mechanisms and as management
commitment to reducing outages was reinforced. Lately the slippage in

Boiler Tubes
the improvement curve suggests renewed attention is needed. Boilers
are, on average, getting older, cycling duty is increasing, and fuel mixes
are changing.
There are about 32 recognized failure mechanisms in six categories of
which the most prevalent are presented in Table 6-3. Significant causes,
the first eight ranked, are listed in bold type. Certainly, some causes ap-
pear often in the thousands of tube failures that still occur each year in
the US. Commonly seen are corrosion fatigue, fly ash erosion, hydrogen
damage, fireside corrosion, and creep. Many stem from poor water
chemistry, some from poor quality coals, some from non-optimum com-
bustion. But all are considered preventable by careful design and opera-
tion of the boiler system and attention to inspection and diagnostics.
Table 6-3 Boiler tube failure mechanisms.

Fatigue Erosion
Corrosion (1) Fly ash (2)
Vibration, fretting and rubbing Sootblower (6)
Thermal Falling slag (8)
Coal particle
Water-Side Corrosion Stress Rupture

Hydrogen damage (3) High temperature creep (4)
Caustic corrosion Short-term overheating in water and
Acid phosphate corrosion steam tubes (5)
Pitting (local corrosion) low temperature creep
Stress corrosion cracking Dissimilar metal welds
Graphitization
Fire-Side Corrosion lack of Quality Control

Waterwall (7) Maintenance cleaning damage
low temperature acid dewpoint Chemical excursion damage
Coal ash Material defects
Oil ash Welding defects
Among waterwall, superheater, reheater, economizer and downcomer

tubes, by far the largest loss of availability is charged to waterwll tube
failures. Superheater and Reheater tube failures, though less significant,
are still important contributors to unavailability while failures of econo-
mizer tubes are uncommon. Failure cause vary with function and loca-
tion. High temperatures, cycling operation and ash contained in coal and
oil fuels can reduce tube operating life. Other causes may include im-
proper chemical cleaning, poor repairs, or soot – blowing.
Boiler tubes may fail due to the following causes (A.F. Armor, R.H.Wolk,
Productivity Improvement Handbook for Fossil Steam Power Plants,
EPRI, September,1998.):
• Corrosion fatigue

Boiler Tubes
• Fly ash corrosion

• Hydrogen damage
• High temperature creep
• Short term overheat

• Erosion caused by soot-blowers
• Fouling slag erosion
• wastage
• Internal corrosion from pitting

Boiler Tubes
• Internal corrosion by caustic gouging
• Acid attack
• Liquid ash corrosion
• Fretting
• Dissimilar metal weld failures (DMW)
• Intergranular stress corrosion cracking (IGSCC)
• Cracking at attachment welds
• Thermal – mechanical fatigue
• Graphitization
• carburization
(h) Basic PoF’

data
Table 6-4 Loss of availability due to boiler tube failures (A.F.
Armor, R.H.Wolk, Productivity Improvement Handbook for
Fossil Steam Power Plants, EPRI, September,1998.)
Boiler Tube Loss of Function Damage Mechanisms
Type Availability
/Material
Waterwall / 2% Surround Wastage-Normally results from
Carbon steel combustion surface oxidation but Low NO.
Low alloy zone. Con- Burners can cause a marked in-
steel With vert water to crease in wastage rates Hydrogen
less than 5 steam Damage-Typically caused by sol-
% alloying ids deposition Intemal Corrosion
elements. from water impurities Corrosion
Fatigue External Corrosion from
furnace combustion gases
Superhea- <1% Increase high Creep resulting from long term
ter/Low alloy pressure overheat Blow-out resulting from
steel steam tem- short term overheat Liquid Ash
stainless perature Corrosion from coal and oil firing
steel (18 % Carburization, particularty under
Ni, 8 % Cr reducing conditions, dissolves pro-
austenitic tective oxides Dissimilar Metal
stainless Weld (DMW) failures Intergranular
steel) Stress Corrosion Cracking
(IGSCC) Flyash Erosion, Wear,
Distortion
Rehea- <1% Increase in- All superheater causes Attachment
ter/Low alloy termediate weld cracking
steel and low pres-
Stainless sure steam
steel temperature
Economizer Very small Increase feed Intemal Corrosion Flyash Erosion
/ Carbon water tem- Thermal Mechanical-Fatigue
steel perature be- Thermal Fatigue at Header Joints
tween boiler
feed pumps
and water-
walls
Downcomer Rare Transport wa- Internal Corrosion Corrosion Fa-
/ Carbon ter from drum tigue Thermal Fatigue at Header
steel to lower wa- Joints
terwall head-
ers
(i) Compo- No data / information available
nent PoF’

Boiler Tubes
related
questions
(j) Basic CoF No data / information available
data
(k) Preventive Tube Type Damage Inspection Inspec- Corrective Ac-
and cor- Mechanism Location tion tion
Tech-
rective ac- nique
tions Waterwall- External corro- Deposits on VT Clean and
especially sion tube sur- UT coat tubes, or
areas of face replace if
high heat wastage is
input severe
Hydrogen Tube walls UT Estimate re-
Damage maining wall
thickness, re-
place if nec-
essary
Corrosion Fa- Surfaces UT Grind and
tigue near buck- weld repair
stays and
windboxes
Pitting Replace or
repair if less
than minimum
wall remains
Superheater Thermal Fa- Hottest por- PT Repair welds
and tigue tion of su-
reheater At DMW perheater
tubing
IGSCC Horizontal UT Replace if
sections corrosion ex-
ceeds 25-50
% of wall
thickness
Economizer Corrosion Weld joint UT Replace if
to inlet wall thickness
and outlet is reduced
headers below mini-
mum
Erosion Tube sur- VT
face
(l) List of No data / information available
problems
for which
further de-
tails are
covered
by the
book
6.6 Economizer Tubing

Economizer Tubing

Economizer Tubing
(m) General Attention should be more specifically devoted to:
• defective suspensions or braces,
• thrust of refractory walls,
• defective spacing combs,
• deformation of bypass tubes resulting from damage,
• deformation of the baffle plates,
• presence of foreign material between the bundles
and
• plug of slag in the gas passage (check before clean-
ing).
For tubes most of the problems would concern:
1. Erosion
2. Corrosion, Figure 6-7
3. Damages at bundles braces, Figure 6-8
at locations shown in Figure 6-9
Figure 6-7 Corrosion in economiser tubes
Figure 6-8 Damage at bundle braces of an economiser tube

Economizer Tubing
Figure 6-9 Typical locations for erosion, corrosion, damage at

bundle braces (SPRINT Project SP249, document GG010)
The more detailed visual inspection concerns the detection of defects

due to erosion coming from the gas side leads to reduction of thickness.
It appears in coal boilers and can be found mainly:
• at the front and backside of the banks where gas velocity can
be higher. Backside is always more affected in second pass
boiler type (centrifugation and concentration of heavy solid par-
ticles),
• on tubes of the elements near the lateral walls. Vertical tubes of
lateral walls have also to be checked mainly where they are
bent,
• everywhere up to the 3th and 4th (or accessible upper an lower)
tube rows of the banks,
• in the surrounding of locations of previous in service damages,
• near soot blowers,
• near spacers, baffles plates (also for mechanical wearing),
• tubes out of alignment,
• where preferential passages exist.
The way of detection is

• oriented lighting in a more or less dark environment,
• calibration and
• by hand touching, palping.

Economizer Tubing
The severity of the damage can be assessed more accurately by thick-
ness measurements (US).
The damages may be ascribed to
• type of coal (ash content),
• speed of gases,
• soot blowers,
• misalignment,
• plugging,
• preferential passages,
• centrifugation and concentration of the solid parti-
cles,
• local turbulence (walls, baffles, combs, ...),
• past local damages and
• vibrations.
In all cases, the tubes accessible after tube removal for replacement
have to be checked.
Corrosion on the gas side leads to a reduction of thickness. It appears:

In service
• at the bottom of the counterflow economizer.
During long or repeated shut down periods

• everywhere with propensity at welds, bends, air en-
trance.
• under refractory or deposits.
The way of detection is

• skimming light in a more or less dark environment,
• calibration and
• hammering of abnormal local oxide layers.
The severity of the damages can be assessed by

• thickness measurement (US) if necessary after pit-
ting removal by grinding.
Corrosion in economiser tubes can be mainly:

• type of fuel ( presence of S, Cl, ...),
• minimum metal temperature compared to the acid
dew point temperature of the combustion gas,
• time of shut down periods without special gas side
protection,
• presence of refractory and
• water cleaning with insufficient neutralization.
Damages at bundles braces can be:

• blocked mobile braces,
• obstructed slip sabots and
• contiguous fix braces.
Each kind of problem can develop cracks in welds or HAZ passing
through the wall tubes. This type of damage can be found at every attach

Economizer Tubing
of the bundle. The visual inspection can only detect important cracks. If
such damages are found,complementary investigations have to be done
by MT, PT and US.
The damage is usually to be ascribed to a concentration of stresses due
to
• thwarted displacement and
• welding defects.
Visual inspection has to be completed by an inspection of the internal of

the tubes by means of non destructive testing (US). Two kinds of defects
are to be looked after: (1) corrosion, (2) erosion. The corrosion may be
ascribed to: quality of water or presence of oxygen (due to disgasing) or
protection procedure for long duration shutdowns (> 2 months). The ero-
sion is usually ascribed to high fluid speeds.
(n) Basic PoF’

data RIMAP Power Default Unit Comments / Notes
Value
Min Mean Max Comm-

Source Unit
value value value ents/Notes
NERC24: 2.129e10 Failure
-5 Rate per
Hour
VGB25: 0.62 Outages/
Unit Year
API 58126: 1e10-4 Failures/
Year
OREDA27: - -
Generic - -
literature
data:
Other data - -
(e.g. inter-
nal com-
pany data)
24
Data from GADS service created by NERC–North American Electric Reliability Council (www.nerc.com)
25
VGB, Technisch-wissenschaftliche Berichte “Wärmekrafwerke”, 1998, ISSN-Nr. 0937-0188
26
API Publication 581, Risk Based Inspection Base Resource Document, 2000
27 rd
OREDA, Offshore Reliability Data, 3 edition published by OREDA Participants, 1997

Economizer Tubing
(o) Compone-
nt PoF’ re- Crisp number Linguistic
Condition Question
lated YES NO YES NO
questions Is there an inspection/testing
Slightly
policy which sets out the in-
0.8 4 de- Increase
spection interval and inspection
creases
requirements for the tubing
Slightly
Is this inspection/testing policy
0.8 5 de- Increase
fully adhered to for the tubing
creases
Strongly
Has a ("window") rupture type Slightly de-
8 0.8 in-
failure ever occurred creases
creases
Strongly
Has a rupture type failure oc-
9 1 in- Unchanged
curred more than once
creases
Are repairs/replacements to the
Slightly
tubing always carried out to Slightly in-
0.8 2.5 de-
documented proce- crease
creases
dures/engineering standards
Are temporary repairs to the
tubing always carried out to Slightly
documented proce- 0.9 5 de- Increase
dures/engineering standards creases
and for a defined lifetime
Are temporary repairs to the
Slightly
tubing always subsequently
0.9 5 de- Increase
replaced within this predefined
creases
period?
Have any economiser tube fail- Strongly
Slightly de-
ures involved violent ruptures 9 0.9 in-
creases
with consequential damage creases
The final CQF (Condition Question Factor) is then calculated as:

CQF = min (CQFi ) × max(CQFi )
E.g. if the “worst” answer was causing increase by factor 9 and the “best”
answer by factor 0.8, CQF would be 7.2 for the crisp number scale and
“Strongly Increase” for the linguistic scale.
(p) Basic CoF

data RIMAP Power Default Value Unit Comments / Notes
Type of
Sour Abbr Mean2 Com-
Conse- Min1) ) Max3) Unit
ce . ments/Notes
quence
Limit of Not considered
FINANCI
liability here
AL
CLL amount 0 0 0 €

Economizer Tubing
Cost of Mean value
lost pro- calculated for 2
duction 42500 days, Max
CLP 22500 810000 €
(direct & 0 value calcu-
indirect) lated for 3
days
Quality Not considered
CQC cost 0 0 0 € here
Budget / Not replaced
CBP Purchas- 0 0 0 €
ing price
Other re- Not replaced
COR placement 0 0 0 €
cost
Repair
CPC cost 1000 1500 2000 €
Additional
CAC inspection 300 470 500 €
cost
Cost of
clean up
explo-
CCU sions, 0 0 0 €
fires,
spills,
leakage
Other cost Cost of public
items image loss,
COC 0 0 0 € increased in-
surance, legal
cost
Explosions
/ Fires m2-
ENVIROMENT
(km
2
)
Large
spills, 2
leakage m
Explo- No.
sions, fires of
HEALTH & SAFETY
spills, fa-
leakage tali-
ties
No.
Explo-
of
sions, fires
inju
spills,
ries
leakage
1)
Minimum value, here given for 80 t/h boiler, block power 30 MWe
2)
Mean value, here given for 2500 t/h boiler, block power 350 MWe
3)
Maximum value, here given for 4000 t/h boilers, block power 720 MWe
Total cost (total financial consequence):

Min: 24300 €
Mean: 426970 €
Max: 812500 €

Economizer Tubing
(q) Preventive See upper levels (Boiler, Boiler tubing)
and cor-
rective ac-
tions
(r) List of Economiser tube failure due to wall thinning
problems f.1. Economiser tube cracking
for which f.2. Economiser fouling
further de- Dependency: Consider f.1. f.2. and f.3. as independent phenomena
tails are (PoF’=Pf1+Pf2+Pf3), see Figure 6-10
covered
by the PoF’ determined
book Generic data at component / Shut down
and questions system level
(see Figure 16)
Repair cost
Problem #1 PoF’ determined
at detailed Economizer
Tube wall
(problem/issue) tube failure
thinning due to
general corrosion related level
Inspection
cost
Problem #2
Tube cracking due
to fatigue Lost of
production
Figure 6-10 Dependency between different failure modes.

6.7 Problem #1: Economiser tube failures due to wall thinning

Problem #1: Economiser tube failures due to wall thinning
(s) Problem Pri- -
ority
(t) Description Wall thinning of economiser tubes can lead to early failures by tube
rupture, water leakage and consequential additional erosion and fail-
ures of adjacent tubes. Several parallel mechanisms often operate to
promote wall thinning.
(u) Damage, Wall thinning of economiser tubes is mainly due to erosion and corro-
cause of sion on the outer surfaces, and usually to lesser extent due to internal
problem corrosion. Wall thinning is generally faster when temperature in-
creases, because many damage mechanisms are accelerated by
higher temperature. At late stages of damage, short-term deformation
can also induces significant wall thinning.
(v) Methods to Wall thinning is mainly observed and quantified by using a combina-
find and tion of visual inspection and systematic or spotwise ultrasonic inspec-
quantify the tion of the wall thickness.
symptoms
(w) Extent of the Wall thinning is usually expressed as loss of wall thickness (in mm),
problem in terms of residual wall thickness (in mm) or as residual fraction of
the initial wall thickness (in %). In addition, the extent of the problem
is frequently described by mapping the distribution of these quantities
on a map of the economiser.
The extent of the problem can be rated as following:
Min. residual wall fraction (t - ta) / (to - ta)1) Extent of wall
thinning
< 25% Very high
25 - 50% High
50 - 75% Modest
75 - 100% Low
1)
for wall thickness, t = current value, to = initial value and ta = allow-
able minimum value


(x) Scale for se- Wall thinning is a common contributor to life limiting damage of
verity of the economisers. According to the calculated residual life the severity can
problem be considered as following:
Wall thinning rate / se- Calculated residual life t

verity
Very high t < 8 000 h (less than about one year)
High 8 000 < t < 25 000 h (1 < t < 3 years)
Modest 25 000 h < t < 100 000 h (3 < t < 12
years)
Insignificant t > 100 000 h (t > 12 years)
Another aspect of the severity of wall thinning is its mapped extent on
the economiser, as following:
Wall thinning severity Affected (to given thinning rate) area A

Very high A > 50%
High 10% < A < 50%
Modest 2% < A < 10
Small A<2%
(y) Suggested The quantified frequencies of the problem can be expressed as fol-
scale for fre- lowing:
quency as-
sessment Criteria Frequency
(Quantitative Qualitative Quantitative
and Qualita- > 10 tube failures/year Very high > 10 / yr
tive) 1 to 10 tube failures / year High 1-10 / yr
1 to 10 tube failures / 10 years Modest 0.1-1 / yr
< 1 tube failure / 10 years Low < 0.1/ yr
1) failures with clear contribution by wall thinning; can be also used
for predicted failure rates
(z) Methods and A probabilistic approach can be used to calculate PoF, combining the
tools to calcu- effects of multiple mechanisms and input quantities, typically includ-
late PoF ing wall thickness and its thinning rate, temperature, pressure (and
when necessary, other loads), and materials strength. Appropriate
tools (programs) available for the purpose are:
• ALIAS – Risk
• ALIAS – Creep
• ALIAS – Fatigue


(aa) Controllability The following scale can be used for controllability / predictability of
/ predictability wall thickness:
of the prob-
lem Criteria Controllability / pre- PoF in-
dictability crease
factor
Good inspection records, no or Very good 1
few failures
Fair inspection records, no or Good 2
few failures
No/poor inspections, no or few Modest 4
failures
No/poor inspections or many Poor 8
failures
(bb) Resources, The resources and constraints regarding wall thinning, together with
constraints the effect on PoF can be classed according to the following table:
Criteria on resources / Effect on PoF PoF increase

constraints factor
Good inspectabil- Low uncertainty 1
ity/repairability
Fair inspectabil- Medium uncertainty 2
ity/repairability
Limited inspectabil- Modest uncertainty 4
ity/repairability
Very limited inspectabil- High uncertainty 8
ity/repairability
(cc) Economic Typically, wall thinning of economisers will inflict the following poten-
conse- tial economic consequences:
quences • inspection cost with accompanying preparation cost
• repair / replacement cost
• mitigation cost due to changes in operation or structures
• loss of production (if any)
The economic consequences can be rated as following:
Condition Economic consequences

Unplanned shutdown, wide re- High
placement
Unplanned shutdown, limited re- Considerable
pairs
No unplanned shutdown, wide re- Modest
placement
No unplanned shutdown, limited Low
repairs


(dd) Environ- Wall thinning will usually not inflict major environmental conse-
mental con- quences. Some impact could be expected from a high rate of failures,
sequences as these would increase operation under transient conditions and
thereby with higher than average emission rates.
The consequences can be rated as following:
Condition Environmental conse-

quences
> 10 unplanned shutdowns / year Modest
1-10 unplanned shutdowns / year Low
< 1 unplanned shutdown / year Very low
(ee) Health and Wall thinning of economisers will usually not inflict significant health
safety conse- and safety consequences.
quences
6.8 Problem #2: Economiser Cracking

Problem #2: Economiser Cracking
(a) Problem Pri- -
ority
(b) Description Cracking of economiser tubes can lead to early tube failures, causing
water leakage and possibly subsequent secondary damage and fail-
ures by the escaping high pressure fluid.
(c) Damage, Cracking of the economisers is often due to thermal or corrosion fa-
cause of tigue, or thermally induced repeated mechanical loading, which in
problem case of corrosion fatigue is enhanced by the boiler environment. It is
also possible that the underlying cause is poor water chemistry, lead-
ing to internal corrosion and corrosion fatigue cracking from the cor-
rosion pits, or sometimes to hydrogen/methane damage from the hy-
drogen released in the corrosion process. Depending on the mecha-
nism, cracking can initiate on either side of the tube wall.
(d) Methods to External cracking of economiser tubes is mainly observed and quanti-
find and fied by visual inspections, surface inspections (MT, PT), and other
quantify the NDT inspections of the economiser. In case of cracking starting from
symptoms the internal tube surfaces, the damage can be often observed by ul-
trasonic testing, and when necessary, diagnosed in more detail from
a tube sample. Indications of early stage tube failures (leaks) may
also be observable by acoustic emission monitoring.

(e) Extent of the Economiser tube cracking can be described in terms of maximum di-
problem mensions of the cracks or cracked regions (crack length, maximum
depth, in mm), depending on crack density and origin. Generally a
crack is a local defect but in case of dense thermal fatigue cracking
on surface, it may be possible to treat the case as in case of wall
thinning (see above).
The extent of the problem can be rated as following:
Failure rate 1) Extent of cracking
> 10 failures /year Very high
1 to 10 failures / year High
1 to 10 failures / 10 years Modest
< 1 failure / 10 years Low
1)
failures leading to shutdown
(f) Scale for se- Economiser tube cracking is generally related to both design and op-
verity of the eration, when thermal fatigue type of mechanisms contribute to the
problem problem, and more operations and water quality related when internal
corrosion processes are involved. According to the mapped extent on
the evaporator the severity can be considered as following:
Severity Affected area A
Very high A > 50%
High 10% < A < 50%
Modest 2% < A < 10
Small A<2%
(g) Suggested The quantified frequencies of the problem can be expressed as fol-
scale for fre- lowing:
quency as-
sessment Criteria Frequency
(Quantitative Qualitative Quantitative
and Qualita- > 10 failures/year Very high > 10 / yr
tive) 1 to 10 failures / year High 1-10 / yr
1 to 10 failures / 10 years Modest 0.1-1 / yr
< 1 failure / 10 years Low < 0.1/ yr
1) failures by thermal or corrosion fatigue; can be also used for pre-
dicted failure rates
(h) Methods and A probabilistic approach can be used to calculate PoF, combining the
tools to calcu- effects of multiple input quantities, typically including geometry, crack
late PoF growth rate, temperature, loading, and material properties.
Appropriate tools (programs) available for the purpose are:

• ALIAS – Risk
• ALIAS – Creep
• ALIAS – Fatigue

(i) Controllability The following scale can be used for controllability / predictability of
/ predictability tube cracking:
of the prob-
lem Criteria Controllability / PoF in-
predictability crease
factor
Good inspection records, no or Very good 1
few failures
Fair inspection records, no or few Good 2
failures
No/poor inspections/monitoring, Modest 4
no or few failures
No/poor inspections/monitoring , Poor 8
many failures
(j) Resources, The resources and constraints regarding tube cracking, together with
constraints the effect on PoF can be classed according to the following table:
Criteria on resources / Effect on PoF PoF increase

constraints factor
Good inspectabil- Low uncertainty 1
ity/repairability
Fair inspectabil- Medium uncertainty 2
ity/repairability
Limited inspectabil- Modest uncertainty 4
ity/repairability
Very limited inspectabil- High uncertainty 8
ity/repairability
(k) Economic Typically, economiser tube cracking will inflict the following potential
conse- economic consequences:
quences • inspection cost with accompanying preparation
cost
• repair / replacement cost
• mitigation cost due to changes in operation or
structures
• loss of production
The economic consequences can be rated as following:
Condition Economic consequences

Unplanned shutdown, wide re- High
placement
Unplanned shutdown, extensive re- Considerable
pairs
No unplanned shutdown, extensive Modest
repairs
No unplanned shutdown, no or few Low
repairs
1) failures by cracking, can be also used for predicted failure rates

(l) Environ- Economiser tube cracking will usually not inflict major environmental
mental con- consequences. Some impact could be expected from a high rate of
sequences failures, as these would increase operation under transient conditions
and thereby with higher than average emission rates.
The consequences can be rated as following:
Condition Environmental conse-

quences
> 10 unplanned shutdowns / year Modest
1-10 unplanned shutdowns / year Low
< 1 unplanned shutdown / year Very low
(m) Health and Economiser tube cracking will usually not inflict significant health and
safety conse- safety consequences.
quences
7. Worked Examples
7.1 Multilevel risk analysis – power plant
7.1.1 Technical background

Note: German technical rules for boilers (TRD) and German standards used in this example
are now European Standards (please see references). The following table shows the correla-
tion between the documents.
TRD / DIN Document EU Standard – EN

TRD 300 EN 12952-1
DIN 17155 and DIN 17175 EN 12952-2
TRD 301 EN 12952-3
TRD 508 EN 12952-4
The PoF determination in this example is based on creep exhaustion (based on material un-
certainties) and fatigue exhaustion. Creep exhaustion is determined using TRD creep curves
(EN 12952-1, EN 12952-3), based on material data as shown in Figure 7-1. Fatigue exhaus-
tion is based on low-bound TRD curve as shown in Figure 7-2.
The creep curve is usually derived from the experimental data, according to recognized pro-
cedures, i.e. ECCC WG1 - Creep Data Validation and Assessment Procedures (ECCC WG1
1995).
Fatigue curve is derived depending on the design temperature and using min[N/20, 2σa /2],
where N is the number of cycles to crack initiation, and 2σa is stress amplitude.
Inputs:
Component geometry according to TRD codes 300/301 (EN 12952-1, EN 12952-
3), please see Figure 7-3.
Design temperature and pressure (see Figure 7-4)

Material data – average creep rupture strength for the component material and
fatigue strength at given temperature
Service time of the component – operational hours (see Figure 7-5)
Figure 7-1 Creep exhaustion calculation based on TRD (now EN 12952)
Fatigue Cycles at 400 °C

[MPa]
100000
2 a
10000
1000
100
10 100 1000 10000 100000 1000000 10000000
N
TRD Curve 2*Sigma 20*N Mean N mean
Figure 7-2 TRD Fatigue curve (with derived mean value curve) at 400°C

Figure 7-3 Component geometry data
Figure 7-4 Design and operating temperature and pressure

Figure 7-5 Service time of the component
Based on data inputted and TRD rules exhaustions are calculated:
ez – creep exhaustion
ew – fatigue exhaustion
It is assumed that average creep rupture strength and fatigue strength have a log-normal dis-
tribution, with 2σ1 (about 97.5% confidence level) at the lower (TRD) curve, and mean value
µ on the mean curve as given by material data for creep.
⎛ ( ln (t )− µ1 ) ⎞
⎜− ⎟
f (t ) =
1 ⎜ 2σ 12 ⎟
⎝ ⎠
e
t 2πσ 12
where:
⎛ µ2 ⎞
⎟, σ = ln⎛⎜ σ + µ ⎞⎟
2 2
µ1 = ln⎜ ⎜ µ2 ⎟
⎜ σ 2 + µ2 ⎟ 1 ⎝ ⎠
⎝ ⎠
σ and µ values are the values in the “real” (non-log scale), whereas σ1 and µ1 are values
(parameters) of the normal distribution in the log scale.
Since we assume that the distribution is normal in the logarithmic space, we can calculate
the parameter σ1 using the above equation as:
µ = MeanTimeToFailure
ln (MeanTimeTo Failure ) − ln (TRDTimeToF ailure )
σ1 =
2
Which gives:
σ = µ ⋅ e (σ ) − 1
2
1
For example, using parameters defined as described above we calculate probability of failure
based on creep, e.g.
PoF(t≤ServiceTime=128000hours) = 4.31E-04%
PoF(ServiceTime=128000hours ≤t≤ServiceTime=200000hours)=
PoF(t≤ServiceTime=200000hours) - PoF(t≤ServiceTime=128000hours) =
5.84E-03% - 4.31E-04% = 5.41E-03%

Examples of distribution for creep and fatigue can be seen in Figure 7-6 and Figure 7-7, re-
spectively.
[MPa] Creep Rupture Strength at 520 °C

1000 0.6
0.5
0.4
0.3
0.2
0.1
100 0
1000 10000 100000 1000000 10000000
Tim e [h]
Average Creep Rupture TRD Curve Extrapol. A
Extrapol. 0.8 sigma Time
Time Mean Actual Time PoF
Figure 7-6 Example of distribution for creep rupture strength at 520°C
Fatigue Cycles at 400 °C

[MPa]
100000 0.35
0.3
a
0.25
2
10000
0.2
0.15
1000
0.1
0.05
100 0
10 TRD 100
Curve 1000 2*Sigma
10000 100000 20*N
1000000 10000000
Mean sigma measured N N
N mean n PoF
Figure 7-7 Example of distribution for fatigue strength at 400°C
7.1.2 Sample case
For the case of this example we will consider 8 components from a power plant. General in-
formation about the sample case plant:
gas turbine 35 MWel and 60 MW of district heating with a coal-fired steam

generator (195 MWel and 150 MW of district heating)
commissioning 1982
gross output 230 MW

net output 210 MW

steam generating capacity 576 t/h
district heating 210 MW
fuel:
low-grade coal
methane gas
converter gas
operating hours: 126168
Components considered in this example:
Name Type
Mix-HEADER Header
Water Separator Separator
SUPERHEATER 4 LI Superheater
SUPERHEATER 4 RE Superheater
HP-OUTLET Header
SUPERHEATER Header
SUPERHEATER-OUTLET T-Piece
Attemperator Attemperator
From this 8 components 10 cases will considered (for 2 components additional failure mode
will be considered)
7.1.3 Screening level
For the screening level of the analysis only the component design data is available. Addi-
tional the number of operating hours is also known.
The following table shows the data available for the components.
Table 7-1 Component design data
Component- Type Material Service Service Operat-
Failure mode tempera- pres- ing hours
ture sure
Mix-HEADER - Header 15NiCuMoNb5 280 238 126168
Leak
Water Separator Separator 15NiCuMoNb5 390 225 126168
- Leak
SUPERHEATER Superheater X20CrMoV121 483 205 126168
4 LI - Leak
SUPERHEATER Superheater X20CrMoV121 483 205 126168
4 RE - Leak
HP-OUTLET - Header X20CrMoV121 540 205 126168
Leak
SUPERHEATER- Header 10CrMoV910 542 44.5 126168
OUTLET - Leak
T-PIECE RA00 - T-Piece X20CrMoV121 540 205 126168
Leak
Attemperator - Attempera- X20CrMoV121 540 205 126168
Leak tor
SUPERHEATER Header X20CrMoV121 483 205 126168
4 LI - break
T-PIECE RA00 - T-Piece X20CrMoV121 540 205 126168
Break

Based on available data and using TRD codes (now EN 14952), using e.g. ALIAS-TRD, ser-
vice stress and exhaustion factors (ez – creep exhaustion, ew – fatigue exhaustion) were cal-
culated (see Table 7-2)
Table 7-2 Calculated component exhaustion values
Component-Failure Type Service Ez [%] Ew [%] Etot[%]
mode stress
Mix-HEADER - Leak Header 135.796 0 11.9 11.9
Water Separator - Separator 110.189 5.52E-08 16.98 16.98
Leak
SUPERHEATER 4 LI Superhea- 108.709 1.6 26.49 28.09
- Leak ter
SUPERHEATER 4 Superhea- 88.408 0.3 19.73 20.03
RE - Leak ter
HP-OUTLET - Leak Header 65.209 20.9 22.67 43.57
SUPERHEATER- Header 26.996 8.6 8.188 16.788
OUTLET - Leak
T-PIECE RA00 - T-Piece 63.146 18 24.98 42.98
Leak
Attemperator - Leak Attempera- 92.32 53.9 24.98 78.88
tor
SUPERHEATER 4 LI Header 108.709 1.6 26.49 28.09
– break
T-PIECE RA00 - T-Piece 63.146 18 24.98 42.98
Break
Data was then inputted into RIMAP software (ALIAS-Risk, see ref. RIMAP 2002d), like
shown in Figure 7-8.
The following step is to define PoF and CoF classes. Following PoF classes were defined
(see also Figure 7-9)
PoF Ez – probability of failure based on creep exhaustion

PoF Ew – probability of failure based on fatigue exhaustion
PoF E – combined probability of failure for PoF Ez and PoF Ew

Figure 7-8 Screening level PoF analysis in ALIAS-Risk
Figure 7-9 Defining PoF classes using ALIAS-Risk

After defining PoF classes, consequence of failure classes were defined as following (see
also Figure 7-10):
Additional replacement cost (€)

Typical repair cost (€)
Production loss by failure (€)
Overall replacement cost (€)
CoF by leak – combined repair/production loss costs (€)
Additional damage to other equipment cost (€)
Combined replace/damage to other equipment cost (€)
Replacement value (€)
Current value (€)
Overall damage by leak costs(€)
CoF by break (€)
Figure 7-10 Defining CoF classes using ALIAS-Risk
When the PoF and CoF classes were defined the failure scenarios (“Bow Tie” diagrams) for
each component were made (see Figure 7-11). Example of a failure scenario for the super-
heater component can be seen in Figure 7-12.

Figure 7-11 Building failure scenarios using ALIAS-Risk
Typical Repair Cost
Overall Damage by
PoF Ez
leak
Additional Damage
to other equipemen
t
SUPERHEATER 4
PoF: PoF E CoF: CoF by Leak
LI - Leak
Lost Production by
PoFEw
Failure
Figure 7-12 “Bow Tie” for supeheater component
In the next step PoF values were calculated based on inputted data and using ALIAS-TRD.
Procedure was done like explained previously in this document (see 7.1.1 Technical back-
ground). Afterwards the calculated PoF values were imported into ALIAS-Risk (see Figure
7-13) and CoF values for each defined CoF class were inputted (see Figure 7-14).

Figure 7-13 Imported calculated PoF values
Figure 7-14 Input of CoF values
Based on PoF and CoF values, following the previously defined scenarios (“Bow Tie” dia-
grams) for each component, risk is determined. Risk map (full report as well) are then auto-
matically generated by ALIAS-Risk. The risk map for this example can be seen in Figure
7-15

0.01
6
8
7 10 3 9
0.001 5
4
2
PoF
0.0001 1
Screening
0.00001
100 1000 10000 100000 1000000 10000000
Consequences (Euro)
Figure 7-15 Risk map after screening level
7.1.4 Intermediate level

After screening, next level of analysis is intermediate. Since monitoring data was available
for this sample case it was decided to perform intermediate analysis for all 8 components/10
cases.
Because of seamless transition between analysis levels in proposed RIMAP approach it is

not necessary to perform all steps performed already in previous (screening) level. Based on
monitoring data, new values of exhaustion based on creep and fatigue (according to TRD,
now EN 14952) could be calculated. Since PoF and CoF classes, as well as the scenarios
were already done in the previous step, the only necessary step in this level is to calculate
again the PoF values based on updated values of exhaustion (the methodology is the same
like in the screening level, only more data is available).
The following table shows new calculated values of PoF:
Component-Failure mode Type PoF

Mix-HEADER - Leak Header 2.03E-11
Water Separator - Leak Separator 2.03706E-05
SUPERHEATER 4 LI - Leak Superheater 0.001345622
SUPERHEATER 4 RE - Leak Superheater 0.000587421
HP-OUTLET - Leak Header 0.000448781
SUPERHEATER-OUTLET - Leak Header 0.002393522
T-PIECE RA00 - Leak T-Piece 1.28E-04
Attemperator - Leak Attemperator 8.35896E-05
SUPERHEATER 4 LI – break Header 0.001345622
T-PIECE RA00 - Break T-Piece 1.28E-04
Newly calculate values were inputted into ALIAS-Risk and new risk map was generated
automatically (see Figure 7-16). In order not to make the risk map overcrowded, only few
components are shown in the figure.

Interesting thing with Figure 7-16 is that it clearly shows the conservatism of low-level
(screening) analysis when compared to intermediate. The arrows show how the components
moved into the areas of lower risk from those determined in the screening level.
0.01
0.001
PoF
10
0.0001 8
2
Screening Intermediate Detailed
0.00001
100 1000 10000 100000 1000000 10000000
Consequences (Euro)
Figure 7-16 Risk map after intermediate analysis
7.1.5 Detailed level

For the most critical component (in our sample case, component 6 – SUPERHEATER Outlet,
Header) it was decided to perform detailed analysis.
The analysis was performed according to the schematics shown in Figure 7-19.
All obtainable data for the component was gathered (including geometry, properties of the
material used etc.) and the analysis was performed for several load cases (so called “worse
cases”). The detailed analysis included:
Stress calculation for the “worse cases”

Creep analysis
Fatigue analysis
Critical crack size calculation
Creep crack growth (see Figure 7-17)
Fatigue crack growth
Corresponding details about this analysis are given in the work of Jovanovic, Maile 2001
(see references).

C* max C* mittel
25
20
15
a [mm]
10
0
10000 100000 1000000
t [h]
Figure 7-17 Creep crack growth with C* (form factor 2.5) (Jovanovic, Maile,
2001))
After performing the detailed analysis and applying the statistical models (like shown in
Figure 7-19), new value of PoF for the component was determined and plotted on the risk
map (see Figure 7-18)
Again it can be seen that the conservatism was preserved and that the detailed analysis
moved the component on the risk map in the region of lower risk from those after screening
and intermediate analysis.
0.01
6
0.001
6
0.0001
0.00001
100 1000 10000 100000 1000000 10000000
Screening Intermediate Detailed
Figure 7-18 Superheater component on a risk map after detailed analysis

Brittle fracture, POD

critical crack not
detected at all.
Crack initiated
D due to creep only
macrocracking
a0 =0mm
p1
t
AND
σ Crack initiated
due to fatigue e.g. according to
only TRD code or EN
13445
p2 PoF = p1 + p2 + p3
N OR OR − p1 ⋅ p2 − p1 ⋅ p3 − p2 ⋅ p3
+ p1 ⋅ p2 ⋅ p2
a0 assumed
Crack initiated due to p a0 a1 acr
creep-fatigue p3
e.g. according to
e = ew + ez = TRD code
n n
ti n p′3
=∑ +∑ i a p
i tRi i N i
CCG FCG
acr
Crack growth
under cyclic Rm
loading (creep- 2 criteria diagram
Rσ a0
fatigue, thermal
shock excluded) Rσ/Rk=2 t(N)
σ
Rσ/Rk=0.5 p3′′
a0 =3mm
Minimum t
detectable size
of the crack Rk p a0 acr
Crack propagation under

assumed thermal shock(s).
p3′′′
Figure 7-19 Example of calculating PoF for the sample case considered

7.2 Examples from process industry

Note: the process industry examples are given as in work of Giribone, Pocachard, 2003 (see
references)
7.2.1 Example of PoF calculation for distillation tower overhead system
7.2.1.1 Design information

In general, a distillation tower is composed of:
• A top (⇒ overhead system): Light gas
• A bottom: Heavy product
• Several shells according to the separation degree
The general material used are:
• Carbon steel as the material of construction
• Monel 400 / Stainless steel as lining / cladding to reduce corrosion prob-
lem in the upper part of the column
Our study is held on the top part of the column, we will consider the following :
• Material of construction = Carbon steel
• Internal lining = Monel 400
• Trays = SS 304
As design data:
• Design thickness = 16 mm
• Design pressure = 3.5 bar
7.2.1.2 Process information
We will consider that the column top is in presence of the following fluid:
Table 7-3 Distillation tower Top part - Process
H2S some ppm
H2O 1% wt.
Chlorides 5 ppm
C1-C2 4% wt.

C3-C4 30% wt.

C5 8% wt.
C6-C8 56% wt.
Mercaptans some ppm
The operating conditions are :

• Temperature = 130°C
• Pressure = 2.5 bar
We will consider 2 cases:
• No inhibition is performed on the overhead system.
• Inhibition is performed (use of neutralising amine / caustic soda injected
in the overhead system of the column) in order to reduce / control the
pH.
We can then consider the following typical values for the corresponding pH:
• pH (without inhibition) = 4
• pH (with inhibition) = 6
7.2.1.3 Corrosion information

According to description of distillation tower overhead system, (see 7.2.1.2), the possible cor-
rosion problems that the equipment can face are:
• Hydrochloric acid (HCl) corrosion.
• CO2 corrosion (Not applicable in our case).
• Low acid corrosion (Not applicable in our case).
• H2S corrosion (Cracking problem)
• Sulfuric and sulphurous acids (Not applicable in our case).
We will focus our analysis only on the HCl corrosion (which is a thinning mechanism).
To sum up the data:
• pH (without inhibition) = 4
• pH (with inhibition) = 6
• Internal lining = Monel 400
• Trays = SS 304
• [Cl-] = 5 ppm
According to the previous data, we can estimate a corrosion rate28:
• Without inhibition
For carbon steel : Corrosion rate = 3 mm/year
For Monel 400 : Corrosion rate = 0.7 mm/year
For SS 304 : Corrosion rate = 0.9 mm/year
• With inhibition
For carbon steel : Corrosion rate = 0.7 mm/year
For Monel 400 : Corrosion rate = 0.05 mm/year
For SS 304 : Corrosion rate = 0.1 mm/year
The use of a filming amine can help reducing these corrosion rates.
28
This corrosion rate correspond to the general one. To consider the pitting, the corrosion rate can be multiplied by 10.

7.2.1.4 Pof Calculation
No inhibition
For the following calculations we will consider the corrosion rate to be equal to 0.7 mm/year.
The equipment has already spent 5 years in the previous service.
Structural reliability
Let us consider the following set of data :
• Material: Alloy 400 (Monel) with and without corrosion inhibition
• UTS= 485 MPa
• Limit state function: M= g(R,D) = R-D
• Probability distribution: Normal
The coefficients of variation are taken equal to the following values:
• cS = 12%
• cD = 15%
The design stress is taken as:
f = 162 MPa which corresponds to a traditional safety factor SF = 3
The initial thickness is 16 mm and corrosion rate r = 0.7 mm/year.
Reliability assessment is performed at time ∆t = 5 years.
Table 7-4 Probability of failure after 5 years

Damage Strengt Thickness Stress
γ β Pf
states h (MPa) (mm) (MPa)
Initial 485 16 161.67 3.00 5.13 1.47×10-7
1 (r =
485 12.5 206.94 2.34 4.22 1.25×10-5
0.7)
2 (r =
485 9 287.41 1.69 2.73 3.19×10-3
1.4)
3 (r= 2.8) 485 2 1293.36 0.37 -3.99 1
Bayesian update
We will consider the following:
It is assumed that the history of the studied top provide low reliability data. We will compare
the effect of the following inspection effectiveness:
• Highly effective (H.E.)
• Usually effective (U.E.)
• Fairly effective (F.E.)
The following calculations are based on the document “Principles of failure probability as-
sessment”.
Then, before inspection:
Table 7-5 Assumed value of PoF before any inspection
Damage states Probabilities

1 0.5
2 0.3
3 0.2

After inspection:
Table 7-6 Value of probability after the 1st inspection
Damage states After H.E. After U.E. After F.E.

1 0.939 0.814 0.658
2 0.056 0.140 0.237
3 0.004 0.047 0.105
Global results
Considering the structural reliability results and the effect of the Bayesian update, we obtain:
Table 7-7 PoF results after completion of a highly effective inspection

Damage LoD29 (before Pf (No in- LoD (after Pf (after in-
Pf
states inspection) spection) inspection) spection)
1 (r = 0.7) 1.25×10-5 0.5 6.25×10-6 0.939 1.17×10-5
2 (r = 1.4) 3.19×10-3 0.3 9.57×10-4 0.056 1.79×10-4
3 (r= 2.8) 1 0.2 0.2 0.004 0.004
TOTAL 0.20096 4.19×10-3
Table 7-8 PoF results after completion of a usually effective inspection

Damage LoD (before in- Pf (No in- LoD (after Pf (after in-
Pf
states spection) spection) inspection) spection)
1 (r = 0.7) 1.25×10-5 0.5 6.25×10-6 0.814 1.02×10-5
2 (r = 1.4) 3.19×10-3 0.3 9.57×10-4 0.140 4.47×10-4
3 (r= 2.8) 1 0.2 0.2 0.047 0.047
TOTAL 0.20096 4.75×10-2
Table 7-9 PoF results after completion of a fairly effective inspection

Pf
1 (r = 0.7) 1.25×10-5 0.5 6.25×10-6 0.658 8.22×10-6
2 (r = 1.4) 3.19×10-3 0.3 9.57×10-4 0.237 7.56×10-4
3 (r= 2.8) 1 0.2 0.2 0.105 0.105
TOTAL 0.20096 0.1058
Even if the corrosion rate is important, the inspection process is “able” to reduce significantly
the probability of failure.
29
LoD stands for “Likelihood of Damage” = Likelihood to have detected the damage that was a priori estimated.

We notice that in the case of a highly effective inspection, this reduction can lead to an ac-
ceptable PoF value.
On the other hand, a fairly effective inspection divides by 2 this probability of failure, how-
ever, the result remains insufficient to make the PoF acceptable : a 2nd inspection will proba-
bly help in reducing this PoF.
With inhibition
For the following calculations we will consider the corrosion rate to be equal to 0.05 mm/year.
The equipment has already spent 5 years in the previous service.
Structural reliability
Let us consider the following set of data :
• Material: Alloy 400 (Monel) with and without corrosion inhibition
• UTS= 485 MPa
• Limit state function: M= g(R,D) = R-D
• Probability distribution: Normal
The coefficients of variation are taken equal to the following values:
• cS = 12%
• cD = 15%
The design stress is taken as:
f = 162 MPa which corresponds to a traditional safety factor SF = 3
The initial thickness is 16 mm and corrosion rate r = 0.05 mm/year
Reliability assessment is performed at time ∆t = 5 years.
Table 7-10 Probability of failure after 5 years

Damage Strength Thickness Stress
γ β Pf
states (MPa) (mm) (MPa)
Initial 485 16 161.67 3.00 5.13 1.47×10-7
1 (r = 0.05) 485 15.75 164.24 2.95 5.07 1.94×10-7
2 (r = 0.1) 485 15.5 166.88 2.91 5.02 2.57×10-7
3 (r= 0.2) 485 15 172.45 2.81 4.91 4.62×10-7
Bayesian update
We will consider the following:
It is assumed that the history of the studied top provide low reliability data. We will compare
the effect of the following inspection effectiveness:
• Highly effective (H.E.)
• Usually effective (U.E.)
• Fairly effective (F.E.)
The following calculations are based on the document “Principles of failure probability as-
sessment”.
Then, before inspection:
Table 7-11 Assumed value of PoF before any inspection
Damage states Probabilities

1 0.5
2 0.3
3 0.2

After inspection:
Table 7-12 Value of probability after the 1st inspection
Damage states After H.E. After U.E. After F.E.

1 0.939 0.814 0.658
2 0.056 0.140 0.237
3 0.004 0.047 0.105
Global results
Considering the structural reliability results and the effect of the Bayesian update, we obtain:
Table 7-13 PoF results after completion of a highly effective inspection
Damage LoD30 (before Pf (No in- LoD (after Pf (after in-
Pf
states inspection) spection) inspection) spection)
1 (r = 0.05) 1.94×10-7 0.5 0.97×10-7 0.939 1.82×10-7
2 (r = 0.1) 2.57×10-7 0.3 0.77×10-7 0.056 1.44×10-8
3 (r= 0.2) 4.62×10-7 0.2 0.92×10-7 0.004 1.85×10-9
TOTAL 2.66×10-7 1.98×10-7
Table 7-14 PoF results after completion of a usually effective inspection

Pf
1 (r = 0.05) 1.94×10-7 0.5 0.97×10-7 0.814 1.58×10-7
2 (r = 0.1) 2.57×10-7 0.3 0.77×10-7 0.140 3.60×10-8
3 (r= 0.2) 4.62×10-7 0.2 0.92×10-7 0.047 2.17×10-8
TOTAL 2.66×10-7 2.16×10-7
Table 7-15 PoF results after completion of a fairly effective inspection

Pf
1 (r = 0.05) 1.94×10-7 0.5 0.97×10-7 0.658 1.28×10-7
2 (r = 0.1) 2.57×10-7 0.3 0.77×10-7 0.237 6.09×10-8
3 (r= 0.2) 4.62×10-7 0.2 0.92×10-7 0.105 4.85×10-8
TOTAL 2.66×10-7 2.37×10-7
As the corrosion rate is very low, even if the probability to detect a wrong result exists, the
risk of error is controlled.
An effective inspection will help to confirm the slow corrosion process.
30
LoD stands for “Likelihood of Damage” = Likelihood to have detected the damage that was a priori estimated.

7.2.2 Example of PoF calculation for HF stripper top
7.2.2.1 Calculation process

As SCC is a non trendable damage, the simple analysis performed for thinning is not appli-
cable. Then, the calculations have to be adapted in order to consider or not this intrinsic
characteristic.
It is proposed to follow :
Cracks have
NO YES
been detected
during inspection
Cracks dimension (a)
PoD
X % - Result OK
Y % - Result not OK
API 581
calculations
Result OK Result not OK
process
Structural Reliability Structural Reliability

calculations with (a) calculations with (1,5.a)
PF1 PF2
Probability of Failure directly

Pf = PF1 + PF2
connected to the PoD/Damage
Figure 7-20 Calculation process – non trendable damages
Note:In the case “Cracks have been detected” and “Result not OK”, the structural reliability
calculations are performed using a default size of 1.5a. This value is only an hypothesis : it
can be refined.
7.2.2.2 Design information
The general material used are:
• Carbon steel
• Monel 400
Our study is held on the top part of the stripper, we will consider the following :
As design data:
• Design thickness = 10.4 mm
• Design pressure = 3.5 bar
7.2.2.3 Process information
We will consider that the column top is in presence of the following fluid:

Table 7-16 Distillation tower Top part - Process

HF 10 % wt.
H2O 1% wt.
C3-C4 89% wt.
The operating conditions are :

7.2.2.4 Corrosion information
As we are looking at the HSC damage mechanism, it is not possible to characterize this
damage by a corrosion rate but by a susceptibility to the damage.
This susceptibility translate the ability for the equipment to cope with the corrosive environ-
ment. The lower it is, the lower is the effect of the corrosive middle on the material.
In our case, the principal factor impacting this susceptibility are:
• Post welding heat treatment (PWHT)
• Material Brinell hardness
• Material sulfur content
• Is equipment rolled and welded during forming ?
• HF content
The data are:
Table 7-17 Hydrogen embrittlement corrosion data
PWHT Yes
Material Brinell hardness < 200 HB
Material sulfur content > 0.01%
Rolled and welded plate ? No
HF content 10% wt.
We obtain in these conditions:

• Hydrogen-Induced Cracking : High susceptibility
• Hydrogen Stress Cracking : No susceptibility
To conclude : The top of the stripper is very likely to suffer from Hydrogen-Induced Cracking
caused by the dissolution of HF due to aqueous electrochemical reaction of this HF with the
iron of the material.
7.2.2.5 Inspection history
Let’s consider the equipment have been inspected in the past. We will assume that the
equivalent number of inspection is 2 corresponding to a highly effective inspection.
The last inspection was performed 2 years ago.
7.2.2.6 PoF calculation
For the following calculations we will consider that the equipment has already spent 10 years
in the previous service without any degradation.
We will consider in our analysis the following 2 cases:
• The inspection has not detected any cracks in the material nor close to
the weldings.

• The inspection has detected some cracks. We will consider for the cal-
culation the one with the highest length a.
Inspection result = No cracks have been detected
Methodology
As proposed, we will use the API 581 methodology. For that, we will use the following
scheme:
Equipment susceptibility
to the damage
Severity index
Inspection data
(number & effectiveness)
STRUCTURAL RELIABILITY
+
Last known state
BAYES UPDATE
Time since last inspection
Generic frequency of failure DAMAGE FACTOR
Probability of failure Pf
Figure 7-21 API 581 calculation process for non trendable damages
8. RISK Consideration
In order to avoid repeating, the issues regarding risk reduction, risk mitigation and links to life
management plan and risk aggregation are not discussed here as they are already given in
other RIMAP documents. Please refer to RIMAP D3.1 document, “Risk Assessment Methods
for use in RBIM” and especially to:
Chapter 7: Mitigating activities and risk reduction

Appendix D: Inspection and probability of detection
Appendix E: Evaluation and risk aggregation
Appendix G: Acceptance criteria
9. Conclusions
RIMAP Application Workbook for Power Industry represents a full, “hands on”, RIMAP appli-
cation guide for performing a risk analysis mainly concentrating on the equipment and prob-
lems that can be found in power plants. Furthermore it gives references to documents and
examples for other types of industries where similar components are used. Furthermore this
workbook has an extension in form of two additional workbook parts (PART II and PART III)

which give more detailed information on components, including tables with values for failure
rates, consequences etc. as well as detailed description of problems that can occur on types
of components used in power industry.
10. References
[API] (1998). API Publication 581, Base Resource Documentation - Risk-Based Inspection,
First Edition, Order # No.: C58101, © 1995-1999, American Petroleum Institute
[API] (1999). API Publication RP 580, Recommended practice for risk-based inspection, ©
1999, American Petroleum Institute
[API] (2000a). API Publication 581, Base Resource Documentation - Risk-Based Inspection,
May 2000, © 2000, American Petroleum Institute
[API] (2000b). API Publication 580, Risk-Based Inspection, API Recommended Practice,
Draft #2, May 2000, © 2000, American Petroleum Institute
[API] (2000c). API Publication 580, Risk-Based Inspection - Lite Version, API Recommended
Practice, Draft #1, May 2000, © 2000, American Petroleum Institute
[EPRI] (1998). EPRI – Productivity Improvement Handbook for Fossil Steam Power Plants,
TR-111217 (1998), A.F. Armor, R.H. Wolk, EPRI
[IEEE] (1986), Standard Reliability Data for Pumps, and Drivers, and Valve Actuators: The
Institute of Electrical and Electronics Engineering, Inc. ISBN-0-471-85686-X; New York, 1986
[KKS] (1988). KKS – Kraftwerk-Kennzeichensystem, VBG-KRAFTWERKSTECHNIK GmbH,

December 1988
[NERC] (1999) North American Electric Reliability Council – GADS service; Generating
Availability Reports (see http://www.nerc.com/~gads/)
[OREDA] (1997). OREDA Offshore Reliability Data, 3ra Edition April 1977, SINTF Industrial
Management, Safety and Reliability, N-7034 Trondheim, Norway, (1997)
[RAC] (1999). Reliability Analysis Center, Database Version 2.20, IIT Research Institute,
New York, 1999 (see http://rac.iitri.org/iPC/servlet/iPCServlet?NPRD-95C)
[RIMAP] (2004) D3.1 Risk Assessment Methods for use in RBIM (with appendices). Ref.Nr.
3-31-F-2004-01-1, RIMAP Consortium 2004.
[VDI] (1984). VDI 3822 Schadensanalyse (Failure Analysis), VDI Richtlinie, VDI-Gesellschaft
Werkstofftechnik, Verein Deutscher Ingenieure – VDI, Februar 1984
Giribone, R. Pocachard, M. (2003). Process Workbook – Examples. BV Report: E&P 10428,

2003.
Jovanovic (2001). Risk-based Life Management of Critical Components in Power and Proc-
ess Plants Supported by Knowledge Management Systems, Dr. Hab. Dissertation, Stuttgart,
2001

Jovanovic, A. Maile, K. (2001). MPA Report – Ergebnisdokument, Auft.Nu.: 949749003. MPA

Stuttgart, October 2001.
Koppen, G. (1998). Development of risk-based inspection, Proc. of the First Intl. Conf. on
NDE Relationship to Structural Integrity for Nuclear and Pressurised Components, vol. II, 20-
22 Oct. 1998, Amsterda, Bieth and Mojaret, Eds., Woodhead Publishing Ltd.
Pasha, A. Allen, R. (2003). Operation and maintenance: Question of integrity. Power Engi-
neering International, journal. Issue January/February, 2003. pp. 28-29.
Saaty T. L. (1990). How to make a decision: The Analytic Hierarchy Process, European
Journal of Operational Research 48, 1990, pp. 9-26
Steuer R. E. (1986). Multiple Criteria Optimization: Theory, Computation, and Application,

New York, Wiley 1986

Contact information
Det Norske Veritas AS (DNV) Bureau Veritas (BV) Staatliche Materialprüfungs- Technical Research Centre of
Mr. Sture Angelsen Mr. Rémy Giribone anstalt (MPA Stuttgart) Findland (VTT)
Veritasveien 1 Place des Reflets 17 BIS Dr. Aleksandar Jovanovic Mr. Pertti Auerkari
N-1322 Høvik Place La Defense Pfaffenwaldring 32 Kemistintie 3
Norway 92400 Courbevoie, CDEX 44 D-70569 Stuttgart Postbox 1704
Tel: +47 67 57 99 00 France Germany FIN-02044 VTT, Espoo
E-mail: Sture.Anglesen@ Tel: +33 1 42 91 54 27 Tel: +49 711 685 3007 Finland
dnv.com E-mail: remy.giribone@ E-mail: jovanovic@ Tel: +358 9 456 6850
URL: www.dnv.com bureauveritas.com mpa.uni-stuttgart.de E-mail: Pertti.Auerkari@
URL: www.bureauveritas.com URL: www.mpa.uni-stuttgart.de vtt.fi
URL: www.vtt.fi
TÜV Industrie Service TNO Industrial Technology Hydro Agri Sluiskil B.V. (HAS) Mitsui Babcock Energy
TÜV SÜD Group Metals Technology (TNO) Mr. Arie deBruyne Limited (MBEL)
Dr.Ing. Robert Kauer Mr. Jan Heerings Industrieweg, Postbox 10 Dr. Barrie Shepherd
Westendstrasse 199 Rondom 1 4541 HJ Sluiskil Technology and Engineering
D-80686 München P.O.Box 6235 Netherlands Porterfield Road
Germany 5600 HE Eindhoven Tel: +31 (0) 115 47 41 16 Renfrew, Renfrewshire
Tel: +49 (89) 57 91 12 77 Netherlands E-mail: arie.de.bruyne@ PA4 8DJ
E-mail: robert.kauer@ Tel: (+31) 40 265 0275 hydro.com UK
tuev-sued.de E-mail: j.heerings@ind.tno.nl URL: www.hydro.com Tel: +44 (0) 141 885 3977
URL: www.tuev-sued.de URL: www.tno.nl E-mail: bshepherd@
mitsuibabcock.com
URL: www.mitsuibabcock.com
ExxonMobil Chemical Ltd. Energie Baden-Württemberg Siemens Aktiengesellschaft European Commission, Direc-
(EXXONMOBIL) Ingenieure GmbH AG (EnBW) (SIEM) torate General Joint Research
Mr. Andrew Herring Dipl.-Ing Jörg Bareiβ Dr. Artur Ulbrich Centre, Petten (JRC)
Beverkae House, Mossmorran Postbox 10 13 11 Wiesenstraβe 25 Dr. Luca Gandossi
KY4 BEP D-70012 Stuttgart D-45466 Mülheim a.d. Ruhr Postbox 2
Cowdenbeath Fife Germany Germany 1755 ZG, Petton
Scotland Tel: +49 (0711) 128 21 24 Tel: +49(208) 456 2853 Netherlands
Tel: +44 (0) 1383 846142 E-mail: j.m.bareiss@ E-mail: artur.ulbrich@ Tel: +31 224 565250
E-mail: andrew.herring@ enbw.com kwu.siemens.de E-mail: luca.gandossi@jrc.nl
exxonmobil.com URL: www.enbw.com URL: www.siemens.de URL: www.jrc.nl
URL: www.exxonmobil.com
Electricity Supply Board (ESB) CORUS UK Ltd. (CORUS) Dow Benelux N.V. (DOW) SOLVAY S.A. (SOLVAY)
Dr. Alan Bissell Mr. Colin Davies Mr. Antoine Baecke Mr. Alain Fobelets
27 Lower Fitzwilliam Street Moorgate Rotherham H. Dowweg Rue de Ransbeek
Dublin 2 South Yorkshire S60 3AR Postbox 48 Postbox 310
Ireland UK 430AA Terneuzen B-1120 Bruxelles
Tel: +353 (1) 702 6467 Tel: +44 (0) 1709 823105 Netherlands Belgium
E-mail: Alan.Bissell@mail.esb.ie E-mail: colin.davies@ Tel: +31 115 67 2667 Tel: +32 2 264 3655
URL: www.esb.ie corusgroup.com E-mail: ambaecke@dow.com E-mail: Alain.Fobelets@
URL: www.corusgroup.com URL: www.dow.com solvay.com
URL: www.solvay.com
DNV Library Services, Veritasveien 1, N-1322 Høvik, Norway

Contacts
Judit Berthelsen tel (+47) 67 57 81 29
Mette Nore tel (+47) 67 57 93 96
Ingunn Lindvik tel (+47) 67 57 82 38
Sigrun Rosholt tel (+47) 67 57 94 47

Workbook Power Part I tcm109-170742

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Workbook Power Part I tcm109-170742

Uploaded by

Copyright:

Available Formats

Document Name: RIMAP Application Workbook for

Document Date: 26.03.2003

No distribution outside RIMAP Consortium

© COPYRIGHT 2004 THE RIMAP Consortium

All rights reserved

The RIMAP project shall:

RIMAP RTD reporting structure is given in below:

Exec. Summary & Introduction to RIMAP

Overview Document (D3.1)

D3.1 and I3.x as Appendices to D3.1

RIMAP Documentation Level - III

RIMAP Application Power Petrochemical Steel Chemical

1. CONCLUSIVE SUMMARY ...........................................................................................12

Revision number: 0 Page 3 of 135 Restricted

Revision number: 0 Page 4 of 135 Restricted

8. RISK CONSIDERATION ............................................................................................132

10. REFERENCES ...........................................................................................................133

Revision number: 0 Page 5 of 135 Restricted

Revision number: 0 Page 6 of 135 Restricted

Revision number: 0 Page 7 of 135 Restricted

FIGURE 7-11 BUILDING FAILURE SCENARIOS USING ALIAS-RISK ............................................118

BFS Betriebsführungssystem, Operation Management System,

Revision number: 0 Page 8 of 135 Restricted

Revision number: 0 Page 9 of 135 Restricted

Revision number: 0 Page 10 of 135 Restricted

Revision number: 0 Page 11 of 135 Restricted

Appendix of the Guideline,

DEMO2 RIMAP Procedure Application Reports

Figure 1-1 Power Industry Application Workbook in RIMAP Framework

Revision number: 0 Page 12 of 135 Restricted

Power Process Chemical

D4.3 Deliverable D4.3a D4.3b D4.3c

Figure 2-1 RIMAP Application Workbook for Power Industry structure

2.2 Requirements and scope

1. Description of the process of the development of an inspection and main-

Revision number: 0 Page 13 of 135 Restricted

scribed (risk criteria. shutdown optimization. regulation, experience and manufac-

 Develop workbook per industry sector.

Table 2-1 Scope of the workbook concerning main systems

Revision number: 0 Page 14 of 135 Restricted

Drums / Pressure vessels

2.3 How to use this document

Table 2-2 “Road map” of the document

Revision number: 0 Page 15 of 135 Restricted

3. RIMAP procedure for power plant components

Additionally one techno-organizational (incl. economy-related aspects) step, namely

a. screening (low level analysis)

Revision number: 0 Page 16 of 135 Restricted

Data collection and

Seamless, multi-level, transition

Figure 3-1 Basic representation of RIMAP procedure.

3.2 Standard format for each step

Revision number: 0 Page 17 of 135 Restricted

3.3 Preparatory analysis

Revision number: 0 Page 18 of 135 Restricted

• Plant operation, process, and maintenance personnel with detailed

Revision number: 0 Page 19 of 135 Restricted

3.3.2.3 Definition of objectives and scope

Revision number: 0 Page 20 of 135 Restricted

Table 3-1 Examples of engineering criteria for determining a failure.

3.3.5 Risk acceptance criteria

Table 3-2 Risk Criteria.

Revision number: 0 Page 21 of 135 Restricted

Develop workbook per industry sector.